Allow list breaks PHP remediation engine

[jurgenhaas]

What happened?

Testing the Drupal integration, I've added an allow list to my organisation and added 1 IP.

The next time, the PHP remediation engine updated the lists in the Drupal site, the following error was thrown:

Retrieved allowlist is not as expected { "type": "REM_RAW_DECISION_NOT_AS_EXPECTED", "raw_decision": "{\"id\":\"691d9e250164af3a45b73838\",\"name\":\"Testing Allow List\",\"description\":\"\",\"url\":\"https:\\\/\\\/blocklists.api.crowdsec.net\\\/allowlists\\\/d361b1c2-c922-4cb8-a66f-46161374de9e\\\/691d9e250164af3a45b73838.txt?AWSAccessKeyId=ASIAX7ZTCFHXMEBELW7E&Signature=DxalWMFRLL7ma2kiyI3RE26YSu4%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEBMaCWV1LXdlc3QtMSJGMEQCIC3F1IGNNISn1Nmm7feBKY%2BEblPtG8gLdhQ7bIv%2FuhigAiBoVa155KXaf0PR4E3hQtLkS1WR%2FKklHfleC4zbcShxUyqDAwjc%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAMaDDU0OTMyNjAzOTUzNCIM8Nu85bOAbxjpwGBOKtcCuCEbvX3Zpj23t6HAYqnh%2Fj3YLcUnXYSR7W4YwSiGSHFNrOBZbOS5zEN%2BKl%2F0lbQ6feCLfTQU6uhfg8JChGmTkYieSlfihHzv6Qgo6OmshIKH1GO%2BYvI1QDNculeqNiNjFMjo7HN3Gs3A1Fr3bxwOjtn6C7UVBWHjDw3PlxznsDtUfKqF58OWhiw4V7XsSA0o5VA%2Bo9BC99y8puEeRxTd0DIfGpVCkm6K8kIFhB2RTBbyKiYgm%2F8wd%2FWmJeUqgDSXNUjogfcQcCBgpH8dArMqGSiKvdtaxk73qQCepNlauO1yQau4vfeIRSMbF1fH1qoSFv71%2Bwu6tkv2CZtW3nH3sekfAA%2B%2Fh1whvvNcUR%2BCTdvEzp9QJyTlxR22D%2F%2FQDfdXwn36CE%2Bp4Xs25ep0lju7M%2BeA72CEGl81I4i%2B097KU5YozPdJvd%2BLBOiI5VoO%2BJ%2BvmAOiVDxGmzDQvvbIBjqfAVKuvs5POXdML6LOWgqlrq134Ty2Nq3Z%2BycMrjuvKELY6aMiGPYkzLNl391IsycOoN3RmPl0WYsjyKnFrLHm6D2UK%2B8F3AqSMoM5jUm8uw3FsYVgW5%2Fbusii%2FUmzslEQwsGuEcpfzPRts4Vpk81Ct%2FZLU7wKofyRHd95TyV%2Fy3uClY7RUq4sEDE4ry5608sgI6qMNFCHF2TU5w2Oy61MIw%3D%3D&Expires=1763549701\",\"scope\":\"ip\"}" }

What did you expect to happen?

This should work without an error.

How can we reproduce it (as minimally and precisely as possible)?

Only with Drupal, I guess.

Anything else we need to know?

No response

Crowdsec version

The latest PHP packages from Crowdsec

OS version

No response

Enabled collections and parsers

No response

Acquisition config

No response

Config show

No response

Prometheus metrics

No response

Related custom configs versions (if applicable) : notification plugins, custom scenarios, parsers etc.

No response

[github-actions]

@jurgenhaas: Thanks for opening an issue, it is currently awaiting triage.

In the meantime, you can:

1. Check Crowdsec Documentation to see if your issue can be self resolved.
2. You can also join our Discord.
3. Check Releases to make sure your agent is on the latest version.

Details

I am a bot created to help the crowdsecurity developers manage community feedback and contributions. You can check out my manifest file to understand my behavior and what I can do. If you want to use this for your project, you can check out the BirthdayResearch/oss-governance-bot repository.

[jurgenhaas]

See also https://www.drupal.org/project/crowdsec/issues/3558717

[julienloizelet]

Hi @jurgenhaas,

Looking in the code of the PHP remediation engine, we don't allow empty description.

https://github.com/crowdsecurity/php-remediation-engine/blob/4050866696b5a7c65ab789513619bc45527f76fb/src/CapiRemediation.php#L390

I suppose we should accept empty description and I will create an issue in the related repo to fix this.

Can you try adding a description to your allow list ?

Thanks

[jurgenhaas]

Oh, interesting. You could otherwise make the description mandatory in the dashboard. I'll give that a try later today and let you know. Thanks.

[jurgenhaas]

Confirmed, when adding a description to the allow list, not only to the IPs, then it works also on the engine side.