Bluecoat analyzer fails if domain contains subdomain

[crackytsi]

Request Type

Bug / Analyzer

Work Environment

N/A

Description

If a domain observable is analyzed that contains a secondary domain like
ocsp.comodoca.com it fails with the following error message:

{
  "errorMessage": "Error: Invalid output\nTraceback (most recent call last):\n  File \"./categorization.py\", line 95, in run\n    result = self.parse_answer(json_answer['categorization'], json_answer['ratedate'])\n  File \"./categorization.py\", line 29, in parse_answer\n    result['category'] = re.findall(regex_category, categorization)[0]\nIndexError: list index out of range\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File \"./categorization.py\", line 100, in run\n    return self.error('{} : {}'.format(json_answer['errorType'], json_answer['error']))\nKeyError: 'errorType'\n\nDuring handling of the above exception, another exception occurred:\n\nTraceback (most recent call last):\n  File \"./categorization.py\", line 108, in <module>\n    BluecoatAnalyzer().run()\n  File \"./categorization.py\", line 102, in run\n    return self.error(b)\n  File \"/usr/local/lib/python3.4/dist-packages/cortexutils/analyzer.py\", line 183, in error\n    ensure_ascii=ensure_ascii)\n  File \"/usr/lib/python3.4/json/__init__.py\", line 178, in dump\n    for chunk in iterable:\n  File \"/usr/lib/python3.4/json/encoder.py\", line 422, in _iterencode\n    yield from _iterencode_dict(o, _current_indent_level)\n  File \"/usr/lib/python3.4/json/encoder.py\", line 396, in _iterencode_dict\n    yield from chunks\n  File \"/usr/lib/python3.4/json/encoder.py\", line 429, in _iterencode\n    o = _default(o)\n  File \"/usr/lib/python3.4/json/encoder.py\", line 173, in default\n    raise TypeError(repr(o) + \" is not JSON serializable\")\nTypeError: KeyError('errorType',) is not JSON serializable\n{\"input\": {\"data\": \"ocsp.comodoca.com\", \"dataType\": \"domain\", \"config\": {\"check_tlp\": false, \"max_tlp\": 3, \"service\": \"\"}, \"tlp\": 2}, \"errorMessage\": \n",
  "input": null,
  "success": false
}

[3c7]

Failed due to an IndexError because of a not expected character in category title. Thanks for reporting.

[crackytsi]

thank you :)