Threat generation does not work - results.map is not a function

[uncatchable-de]

Describe the bug
Clicking on "+ STRIDE per element..." in the manage threat section does not generate any threat. Happens on Windows and MacOS with version 1.5.0.

Expected behaviour
Expected to have some threats automatically generated.

Environment

• Version: 1.5.0
• Platform: Desktop App
• OS: MacOS & Windows
• Browser: -

To Reproduce

1. Open Demo model
2. Open the example diagram
3. Select "STRIDE" as model.
4. Add a new element and select it
5. Click "+ STRIDE per element..." in the "Manage Threats" section

Any additional context, screenshots, etc
Error message from the developer tools console on MacOS (same error also occurs on Windows):

/Applications/OWASP-Threat-Dragon.app/Contents/Resources/app.asar/core/services/threatengine.js:34 Uncaught (in promise) TypeError: results.map is not a function
at onCompleted (/Applications/OWASP-Threat-Dragon.app/Contents/Resources/app.asar/core/services/threatengine.js:34)
onCompleted @ /Applications/OWASP-Threat-Dragon.app/Contents/Resources/app.asar/core/services/threatengine.js:34
Promise.then (async)
generateThreats @ /Applications/OWASP-Threat-Dragon.app/Contents/Resources/app.asar/core/diagrams/diagram.js:235
scope.onSuggestThreats @ /Applications/OWASP-Threat-Dragon.app/Contents/Resources/app.asar/core/diagrams/elementpropdirectives.js:88
(anonymous) @ /Applications/OWASP-Threat-Dragon.app/Contents/Resources/app.asar/node_modules/angular/angular.js:17073
callback @ /Applications/OWASP-Threat-Dragon.app/Contents/Resources/app.asar/node_modules/angular/angular.js:29123
$eval @ /Applications/OWASP-Threat-Dragon.app/Contents/Resources/app.asar/node_modules/angular/angular.js:19523
$apply @ /Applications/OWASP-Threat-Dragon.app/Contents/Resources/app.asar/node_modules/angular/angular.js:19622
(anonymous) @ /Applications/OWASP-Threat-Dragon.app/Contents/Resources/app.asar/node_modules/angular/angular.js:29127
defaultHandlerWrapper @ /Applications/OWASP-Threat-Dragon.app/Contents/Resources/app.asar/node_modules/angular/angular.js:3891
eventHandler @ /Applications/OWASP-Threat-Dragon.app/Contents/Resources/app.asar/node_modules/angular/angular.js:3879

[lreading]

Thank you for the report!

Interestingly, I found that a couple of unit tests are failing with this same issue, but only when run on windows, not on linux.

[jgadsden]

ah, yes, thankyou @uncatchable-de , I have just tested it and indeed it does not work. Demerit for me I think

@lreading this is pretty serious, we have a loss of functionality that I have introduced with all the rearranging of desktop + core files
Do we want to bin the version 1.5.0 release and get a 1.5.1 out as soon as I can?

[jgadsden]

hmmm, yes, I updated json-rules-engine and at the same time I broke the unit tests so did not spot this

json-rules-engine has gone from 3.1.0 to 6.1.2 and I have not tested this breaking change properly - will look for a fix

[lreading]

I find it interesting that it was passing on linux though... It makes me wonder about some of the tests. I've been digging into them a bit and we're using at least one or two extremely out of date and/or unmaintained libraries for testing. Probably due for an overhaul at some point in the near future. :)

Let me know what I can do to help, @jgadsden !

[jgadsden]

Well, the fix is really easy. Line 34 in threatengine.js changes from
return results.map(function(result) {
to
return results.events.map(function(result) {

However json-rules-engine has also changed the path condition helper, so that needs a fix up as well ...

[uncatchable-de]

Thank you for the fast fix @jgadsden. Will there be a new release of 1.5.0 with that fix included? I think it is an essential feature for creating threat models.

[jgadsden]

We have the fixes in place, and we expect a new version 1.5.1 to be released in the next few days.
@lreading is updating the release process, so that snaps are signed, Windows NSIS is signed and the MacOS image is notarized ... nearly there on all of this

[lreading]

@uncatchable-de - Version 1.5.3 has been released, which contains the fix for this issue., Thanks again for reporting this!