github
Add `client-response` Threat Model and update JS ClientsRequests
I've added the client-response threat model to the Threat Modelling shared library. This is a new local threat model that includes the sources of client libraries (mainly focuses at JavaScript / Typescript).
This is needed to discover XSS or other types of security issues when the source of untrusted data in the response content of REST, GraphQL, Soap, etc. clients.
Could you say a few words about why the existing response threat model is not doing what you want? Is it because you want local to enable the threat sources from response?
Correct, right now you can't enable response using either remote or local models because JavaScript has disabled response models by default.
Default Setup cannot use response. This will allow it to.
I would argue for allowing response in remote, since we should favour increasing true positives, over some possible false positives.
I haven't seen the data on the testing, but I understand a decision last year was made to favour work on dealing with false negatives over false positives - this decision to make response harder to use seems to run counter to that, I don't understand the reasoning.
Allowing an explicit response threat model in Default Setup is an alternative to this PR.
