[backend] check indicator pattern syntax when update

OpenCTI-Platform · Oct 22, 2024 · 82b87ed · 82b87ed
1 parent e44e755
commit 82b87ed
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 9 deletions.
diff --git a/opencti-platform/opencti-graphql/src/modules/indicator/indicator-domain.ts b/opencti-platform/opencti-graphql/src/modules/indicator/indicator-domain.ts
@@ -336,6 +336,16 @@ export const indicatorEditField = async (context: AuthContext, user: AuthUser, i
  finalInput.push({ key: 'valid_until', value: [newValidUntilDate.toISOString()] });
  }
  }
+ // check indicator pattern syntax
+ const patternEditInput = input.find((e) => e.key === 'pattern');
+ if (patternEditInput) {
+ const patternType = indicator.pattern_type.toLowerCase();
+ const formattedPattern = cleanupIndicatorPattern(patternType, patternEditInput.value[0]);
+ const check = await checkIndicatorSyntax(context, user, patternType, formattedPattern);
+ if (check === false) {
+ throw FunctionalError(`Indicator of type ${indicator.pattern_type} is not correctly formatted.`);
+ }
+ }
  logApp.info('indicatorEditField finalInput', { finalInput });
  return stixDomainObjectEditField(context, user, id, finalInput, opts);
 };

diff --git a/opencti-platform/opencti-graphql/tests/02-integration/02-resolvers/indicator-test.ts b/opencti-platform/opencti-graphql/tests/02-integration/02-resolvers/indicator-test.ts
@@ -1,6 +1,6 @@
 import { expect, it, describe } from 'vitest';
 import gql from 'graphql-tag';
-import { queryAsAdmin } from '../../utils/testQuery';
+import { adminQuery, queryAsAdmin } from '../../utils/testQuery';
 import { ENTITY_DOMAIN_NAME } from '../../../src/schema/stixCyberObservable';
 import { MARKING_TLP_GREEN } from '../../../src/schema/identifier';
 import type { BasicStoreEntityEdge } from '../../../src/types/store';
@@ -94,6 +94,15 @@ const CREATE_QUERY = gql`
  }
 `;
 
+const UPDATE_QUERY = gql`
+ mutation IndicatorFieldPatch($id: ID!, $input: [EditInput!]!) {
+ indicatorFieldPatch(id: $id, input: $input) {
+ id
+ name
+ }
+ }
+`;
+
 describe('Indicator resolver standard behavior', () => {
  let firstIndicatorInternalId: string;
  let secondIndicatorInternalId: string;
@@ -203,15 +212,15 @@ describe('Indicator resolver standard behavior', () => {
  expect(indicatorCreatedEarlier).toBeDefined();
  }
  });
+ it('should not update indicator with incorrectly formatted pattern', async () => {
+ const queryResult = await adminQuery({
+ query: UPDATE_QUERY,
+ variables: { id: firstIndicatorInternalId, input: { key: 'pattern', value: ["[domain-name:value &&& 'www.wrong.pattern']"] } },
+ });
+ expect(queryResult.errors).toBeDefined();
+ expect(queryResult.errors[0].message).toBe('Indicator of type stix is not correctly formatted.');
+ });
  it('should update indicator', async () => {
- const UPDATE_QUERY = gql`
- mutation IndicatorFieldPatch($id: ID!, $input: [EditInput!]!) {
- indicatorFieldPatch(id: $id, input: $input) {
- id
- name
- }
- }
- `;
  const queryResult = await queryAsAdminWithSuccess({
  query: UPDATE_QUERY,
  variables: { id: firstIndicatorInternalId, input: { key: 'name', value: ['Indicator - test'] } },