Application decomposition maps how data moves through an application and identifies every component involved in processing it. In threat modeling, it answers: “What are we working on?” section 2.2 section 2.2.1
Use data flow diagrams to expose attack vectors, including overlooked calls to internal or external services. A missing public-to-internal API flow can hide SSRF risks, data leaks, and unauthorized access to internal systems. section 2.2.1
A practical decomposition should:
- Trace actions such as updating a profile picture through every processing component. section 2.2.1
- Include API calls to internal and external services. section 2.2.1
- Involve relevant engineers and product stakeholders when drawing and checking the flows. section 2.2.1
External avatar URL
A user submits an external URL for an avatar. If the public API fetches it without adequate controls, an attacker may scan private network ports, reach internal services or databases, or leak access tokens.
