Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix GetIndicatorDBotScoreFromCache to handle better a special character #31070

Merged
merged 20 commits into from
Nov 27, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions Packs/CommonScripts/ReleaseNotes/1_12_49.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@

#### Scripts

##### GetIndicatorDBotScoreFromCache

- Fixed an issue where the script failed when providing indicator values with special characters.
- Updated the Docker image to: *demisto/python3:3.10.13.80593*.
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,11 @@ def main():
values: list[str] = argToList(demisto.args().get("value", None))
unique_values: set[str] = {v.lower() for v in values} # search query is case insensitive

query = f"""value:({' '.join([f'"{value}"' for value in unique_values])})"""
demisto.debug(f'{query=}')

res = demisto.searchIndicators(
query=f'value:({" ".join(unique_values)})',
query=query,
populateFields='name,score,aggregatedReliability,type,expirationStatus',
)

Expand Down Expand Up @@ -67,5 +70,5 @@ def main():
return_results(not_found_values_entry)


if __name__ == "__builtin__" or __name__ == "builtins": # pragma: no cover
if __name__ in ("__builtin__", "builtins", "__main__"): # pragma: no cover
main()
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ comment: Get the overall score for the indicator as calculated by DBot.
commonfields:
id: GetIndicatorDBotScoreFromCache
version: -1
dockerimage: demisto/python3:3.10.13.80014
dockerimage: demisto/python3:3.10.13.80593
enabled: true
name: GetIndicatorDBotScoreFromCache
runas: DBotWeakRole
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -138,3 +138,23 @@ def test_multiple_iocs_with_same_value_but_different_casing(mocker):

indicators_results = return_results_calls[0][0][0]["Contents"]
assert {i["Indicator"] for i in indicators_results} == expected_found


def test_query_values(mocker):
"""
Given:
An array of indicator value (Test~.com, Test2~.com).
When:
Running GetIndicatorDBotScoreFromCache script.
Then:
Ensure all values in the query to demisto.searchIndicators has \".
"""
mocker.patch.object(demisto, "args", return_value={"value": "Test~.com, Test2~.com"})
mocker.patch.object(demisto, "searchIndicators")
GetIndicatorDBotScoreFromCache.main()
args_list = demisto.searchIndicators.call_args_list
call_query = args_list[0][1]['query']
assert call_query in [
'value:("test2~.com" "test~.com")',
'value:("test~.com" "test2~.com")',
]
2 changes: 1 addition & 1 deletion Packs/CommonScripts/pack_metadata.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"name": "Common Scripts",
"description": "Frequently used scripts pack.",
"support": "xsoar",
"currentVersion": "1.12.48",
"currentVersion": "1.12.49",
"author": "Cortex XSOAR",
"url": "https://www.paloaltonetworks.com/cortex",
"email": "",
Expand Down
Loading