[backend] fix stix tests and logic engine

Author: Archidoit

opencti-platform/opencti-graphql/src/utils/filtering/boolean-logic-engine.ts

@@ -61,7 +61,7 @@ export const testGenericFilter = <T extends string | number | boolean>(
       || (op === 'ends_with' && adaptedFilterValues.every((v) => stixCandidates.some((c) => typeof c === 'string' && typeof v === 'string' && c.endsWith(v))))
       || (op === 'not_ends_with' && adaptedFilterValues.every((v) => !stixCandidates.some((c) => typeof c === 'string' && typeof v === 'string' && c.endsWith(v))))
       || (op === 'only_eq_to' && adaptedFilterValues.every((v) => stixCandidates.includes(v)) && stixCandidates.every((c) => adaptedFilterValues.includes(c)))
-      || (op === 'not_only_eq_to' && !adaptedFilterValues.every((v) => stixCandidates.every((c) => c === v)))
+      || (op === 'not_only_eq_to' && !(adaptedFilterValues.every((v) => stixCandidates.includes(v)) && stixCandidates.every((c) => adaptedFilterValues.includes(c))))
       || (op === 'search' && adaptedFilterValues.every((v) => stixCandidates.some((c) => typeof c === 'string' && typeof v === 'string'
         && (v.split(' ').some((word) => c.includes(word)))))) // a stix candidate should contain at least one of the filter values words
 
@@ -82,8 +82,8 @@ export const testGenericFilter = <T extends string | number | boolean>(
       || (op === 'not_starts_with' && adaptedFilterValues.some((v) => !stixCandidates.some((c) => typeof c === 'string' && typeof v === 'string' && c.startsWith(v))))
       || (op === 'ends_with' && adaptedFilterValues.some((v) => stixCandidates.some((c) => typeof c === 'string' && typeof v === 'string' && c.endsWith(v))))
       || (op === 'not_ends_with' && adaptedFilterValues.some((v) => !stixCandidates.some((c) => typeof c === 'string' && typeof v === 'string' && c.endsWith(v))))
-      || (op === 'only_eq_to' && adaptedFilterValues.some((v) => stixCandidates.includes(v)) && stixCandidates.every((c) => adaptedFilterValues.includes(c)))
-      || (op === 'not_only_eq_to' && !adaptedFilterValues.some((v) => stixCandidates.every((c) => c === v)))
+      || (op === 'only_eq_to' && stixCandidates.length === 1 && adaptedFilterValues.some((v) => stixCandidates[0] === v))
+      || (op === 'not_only_eq_to' && !(stixCandidates.length === 1 && adaptedFilterValues.some((v) => stixCandidates[0] === v)))
       || (op === 'search' && adaptedFilterValues.some((v) => stixCandidates.some((c) => typeof c === 'string' && typeof v === 'string'
         && (v.split(' ').some((word) => c.includes(word)))))) // a stix candidate should contain at least one of the filter values words
 

opencti-platform/opencti-graphql/tests/03-integration/01-database/filters-test.js

@@ -7,6 +7,7 @@ import { isStixMatchFilterGroup_MockableForUnitTests } from '../../../src/utils/
 
 // -- File to test stix filtering (filters on events: in the context of playbooks, streams, triggers)
 // -- with different keys, operators, modes, combinations
+// -- applied on data of the file DATA-TEST-FILTERS.json
 
 const WHITE_TLP = { standard_id: 'marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9', internal_id: null };
 
@@ -180,7 +181,7 @@ describe('Filters testing', () => {
       mode: 'and',
       filters: [{
         key: ['objectLabel'],
-        values: ['attack-pattern'],
+        values: ['identity'],
         operator: 'not_only_eq_to',
         mode: 'or',
       }],
@@ -200,6 +201,8 @@ describe('Filters testing', () => {
       filterGroups: [],
     };
     filteredObjects = await applyFilters(filters);
+    expect(filteredObjects.length).toBe(1);
+    expect(filteredObjects[0].name).toBe('ANSSI');
     // With not_only_eq_to & AND local mode
     filtersNot = {
       mode: 'and',
@@ -213,7 +216,7 @@ describe('Filters testing', () => {
     };
     filteredObjectsNot = await applyFilters(filtersNot);
     expect(stixBundle.objects.length - filteredObjects.length).toBe(filteredObjectsNot.length);
-    expect(filteredObjects.map((n) => n.node.name).includes('ANSSI')).toBeFalsy();
+    expect(filteredObjectsNot.map((n) => n.name).includes('ANSSI')).toBeFalsy();
     // With only_eq_to & OR local mode
     filters = {
       mode: 'and',
@@ -227,6 +230,18 @@ describe('Filters testing', () => {
     };
     filteredObjects = await applyFilters(filters);
     expect(filteredObjects.length).toBe(10);
+    filters = {
+      mode: 'and',
+      filters: [{
+        key: ['objectLabel'],
+        values: ['identity', 'note'],
+        operator: 'only_eq_to',
+        mode: 'or',
+      }],
+      filterGroups: [],
+    };
+    filteredObjects = await applyFilters(filters);
+    expect(filteredObjects.length).toBe(11);
   });
 
   // revoked

opencti-platform/opencti-graphql/tests/data/filters/DATA-TEST-FILTERS.json

@@ -8,7 +8,7 @@
       "spec_version": "2.1",
       "name": "ANSSI",
       "identity_class": "organization",
-      "labels": ["identity"],
+      "labels": ["identity", "organization"],
       "created": "2020-02-23T23:40:53.575Z",
       "modified": "2020-02-27T08:45:39.351Z",
       "x_opencti_organization_type": "CSIRT",