Skip to content

Commit 586a906

Browse files
nadouaninadouani
committed
Merge branch 'release/2.1.0'
2 parents 3978d77 + 8284c09 commit 586a906

File tree

7 files changed

+59
-42
lines changed

7 files changed

+59
-42
lines changed

‎cortexutils/analyzer.py‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33

44
import json
55
import os
6+
import stat
67

78
from cortexutils.extractor import Extractor
89
from cortexutils.worker import Worker
@@ -76,12 +77,16 @@ def artifacts(self, raw):
7677
def build_artifact(self, data_type, data, **kwargs):
7778
if data_type == 'file':
7879
if os.path.isfile(data):
79-
(dst, filename) = tempfile.mkstemp(dir=os.path.join(self.job_directory, "output"))
80-
with open(data, 'r') as src:
81-
copyfileobj(src, os.fdopen(dst, 'w'))
82-
kwargs.update({'dataType': data_type, 'file': ntpath.basename(filename),
83-
'filename': ntpath.basename(data)})
84-
return kwargs
80+
dst = tempfile.NamedTemporaryFile(
81+
dir=os.path.join(self.job_directory, "output"), delete=False)
82+
with open(data, 'rb') as src:
83+
copyfileobj(src, dst)
84+
dstfname = dst.name
85+
dst.close()
86+
os.chmod(dstfname, 0o444)
87+
kwargs.update({'dataType': data_type, 'file': os.path.basename(dst.name),
88+
'filename': os.path.basename(data)})
89+
return kwargs
8590
else:
8691
kwargs.update({'dataType': data_type, 'data': data})
8792
return kwargs

‎cortexutils/worker.py‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,7 @@ def __init__(self, job_directory):
2626
else: # If input file doesn't exist, fallback to old behavior and read input from stdin
2727
self.job_directory = None
2828
self.__set_encoding()
29-
r, w, e = select.select([sys.stdin], [], [], self.READ_TIMEOUT)
30-
if sys.stdin in r:
29+
if not sys.stdin.isatty():
3130
self._input = json.load(sys.stdin)
3231
else:
3332
self.error('Input file doesn''t exist')
@@ -142,15 +141,16 @@ def error(self, message, ensure_ascii=False):
142141
:param message: Error message
143142
:param ensure_ascii: Force ascii output. Default: False"""
144143

144+
# Get analyzer input
145145
analyzer_input = self._input
146-
if 'password' in analyzer_input.get('config', {}):
147-
analyzer_input['config']['password'] = 'REMOVED'
148-
if 'key' in analyzer_input.get('config', {}):
149-
analyzer_input['config']['key'] = 'REMOVED'
150-
if 'apikey' in analyzer_input.get('config', {}):
151-
analyzer_input['config']['apikey'] = 'REMOVED'
152-
if 'api_key' in analyzer_input.get('config', {}):
153-
analyzer_input['config']['api_key'] = 'REMOVED'
146+
147+
# Define sensitive key values
148+
secrets = ['password', 'key', 'secret']
149+
150+
# Loop over all the sensitive config names and clean them
151+
for config_key, v in analyzer_input.get('config', {}).items():
152+
if any(secret in config_key.lower() for secret in secrets):
153+
analyzer_input.get('config', {})[config_key] = 'REMOVED'
154154

155155
self.__write_output({'success': False,
156156
'input': analyzer_input,

‎setup.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
setup(
44
name='cortexutils',
5-
version='2.0.0',
5+
version='2.1.0',
66
description='A Python library for including utility classes for Cortex analyzers and responders',
77
long_description=open('README').read(),
88
author='TheHive-Project',

‎tests/fixtures/test-error-response.json‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@
55
"password": "secret",
66
"key": "secret",
77
"apikey": "secret",
8-
"api_key": "secret"
8+
"api_key": "secret",
9+
"apiSecret": "secret",
10+
"api_Pass": "secret",
11+
"API": "secret"
12+
913
}
1014
}

‎tests/test_suite_analyzer.py‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ def test_check_tlp_disabled(self):
7575

7676
# Using the _Analyzer__check_tlp notation to access managed method
7777
# __check_tlp
78-
self.assertEqual(self.analyzer._Analyzer__check_tlp(), True)
78+
self.assertEqual(self.analyzer._Worker__check_tlp(), True)
7979

8080
def test_check_tlp_ko(self):
8181
self.analyzer.enable_check_tlp = True
@@ -84,7 +84,7 @@ def test_check_tlp_ko(self):
8484

8585
# Using the _Analyzer__check_tlp notation to access managed method
8686
# __check_tlp
87-
self.assertEqual(self.analyzer._Analyzer__check_tlp(), False)
87+
self.assertEqual(self.analyzer._Worker__check_tlp(), False)
8888

8989
def test_check_tlp_ok(self):
9090
self.analyzer.enable_check_tlp = True
@@ -93,7 +93,7 @@ def test_check_tlp_ok(self):
9393

9494
# Using the _Analyzer__check_tlp notation to access managed method
9595
# __check_tlp
96-
self.assertEqual(self.analyzer._Analyzer__check_tlp(), True)
96+
self.assertEqual(self.analyzer._Worker__check_tlp(), True)
9797

9898

9999
class TestErrorResponse(unittest.TestCase):
@@ -107,13 +107,17 @@ def test_error_response(self):
107107
self.assertEqual(self.analyzer.get_param('config.key'), "secret")
108108
self.assertEqual(self.analyzer.get_param('config.apikey'), "secret")
109109
self.assertEqual(self.analyzer.get_param('config.api_key'), "secret")
110+
self.assertEqual(self.analyzer.get_param('config.apiSecret'), "secret")
111+
self.assertEqual(self.analyzer.get_param('config.api_Pass'), "secret")
112+
self.assertEqual(self.analyzer.get_param('config.API'), "secret")
113+
110114

111115
# Run the error method
112116
with self.assertRaises(SystemExit):
113117
self.analyzer.error('Error', True)
114118

115119
# Get the output
116-
output = self.analyzer.fpoutput.getvalue().strip()
120+
output = sys.stdout.getvalue().strip()
117121
json_output = json.loads(output)
118122

119123
self.assertEqual(json_output['success'], False)
@@ -124,6 +128,10 @@ def test_error_response(self):
124128
self.assertEqual(json_output['input']['config']['key'], 'REMOVED')
125129
self.assertEqual(json_output['input']['config']['apikey'], 'REMOVED')
126130
self.assertEqual(json_output['input']['config']['api_key'], 'REMOVED')
131+
self.assertEqual(json_output['input']['config']['apiSecret'], 'REMOVED')
132+
self.assertEqual(json_output['input']['config']['api_Pass'], 'secret')
133+
self.assertEqual(json_output['input']['config']['API'], 'secret')
134+
127135

128136

129137
class TestReportResponse(unittest.TestCase):
@@ -137,7 +145,7 @@ def test_report_response(self):
137145
self.analyzer.report({'report_id': '12345'})
138146

139147
# Get the output
140-
output = self.analyzer.fpoutput.getvalue().strip()
148+
output = sys.stdout.getvalue().strip()
141149
json_output = json.loads(output)
142150

143151
self.assertEqual(json_output.get('success'), True)

‎tests/test_suite_extractor.py‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -113,34 +113,34 @@ def test_iterable(self):
113113
})
114114
l_expected = [
115115
{
116-
'type': 'hash',
117-
'value': '7ef8b3dc5bf40268f66721a89b95f4c5f0cc08e34836f8c3a007ceed193654d4'
116+
'dataType': 'hash',
117+
'data': '7ef8b3dc5bf40268f66721a89b95f4c5f0cc08e34836f8c3a007ceed193654d4'
118118
},
119119
{
120-
'type': 'ip',
121-
'value': '127.0.0.1'
120+
'dataType': 'ip',
121+
'data': '127.0.0.1'
122122
},
123123
{
124-
'type': 'url',
125-
'value': 'https://nestedurl.verynested.com'
124+
'dataType': 'url',
125+
'data': 'https://nestedurl.verynested.com'
126126
},
127127
{
128-
'type': 'domain',
129-
'value': 'google.de'
128+
'dataType': 'domain',
129+
'data': 'google.de'
130130
},
131131
{
132-
'type': 'domain',
133-
'value': 'bing.com'
132+
'dataType': 'domain',
133+
'data': 'bing.com'
134134
},
135135
{
136-
'type': 'fqdn',
137-
'value': 'www.fqdn.de'
136+
'dataType': 'fqdn',
137+
'data': 'www.fqdn.de'
138138
}
139139
]
140140

141141
# Sorting the lists
142-
l_real = sorted(l_real, key=lambda k: k['value'])
143-
l_expected = sorted(l_expected, key=lambda k: k['value'])
142+
l_real = sorted(l_real, key=lambda k: k['data'])
143+
l_expected = sorted(l_expected, key=lambda k: k['data'])
144144

145145
self.assertEqual(
146146
l_real,

‎tests/test_suite_integration.py‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,13 +27,13 @@ def test_output(self):
2727
self.analyzer.report({'result': '1.2.3.4'})
2828

2929
# Grab the output
30-
output = self.analyzer.fpoutput.getvalue().strip()
30+
output = sys.stdout.getvalue().strip()
3131
json_output = json.loads(output)
3232

3333
# Checks
3434
self.assertNotIn(self.analyzer.get_data(), output)
35-
self.assertEqual(json_output['artifacts'][0]['value'], '1.2.3.4')
36-
self.assertEqual(json_output['artifacts'][0]['type'], 'ip')
35+
self.assertEqual(json_output['artifacts'][0]['data'], '1.2.3.4')
36+
self.assertEqual(json_output['artifacts'][0]['dataType'], 'ip')
3737

3838
class AnalyzerExtractorNoResultTest(unittest.TestCase):
3939
def setUp(self):
@@ -51,8 +51,8 @@ def test_output(self):
5151
})
5252

5353
# Grab the output
54-
output = self.analyzer.fpoutput.getvalue().strip()
54+
output = sys.stdout.getvalue().strip()
5555
json_output = json.loads(output)
5656

5757
# Check for empty artifact list
58-
self.assertEqual(json_output['artifacts'], [], 'Artifact list should be empty.')
58+
self.assertEqual(json_output['artifacts'], [], 'Artifact list should be empty.')

0 commit comments

Comments
 (0)