MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

fix: [module results] References between objects returned with module results and the original object attribute are now pointing to the original object itself 

- A reference between an object and an object
  attribute is supported in the API, but does not
  appear on the event graph
- Instead of pointing to the initial object
  attribute then, we look for the uuid of the
  object containing the attribute and use this
  uuid for the reference
- The references between objects returned as
  module results and the object containing the
  attribute initially used for the enrichment
  with a module are then handled properly
pull/7420/head
chrisr3d 2021-05-11 17:26:07 +02:00
parent 63181d2219
commit 258e68df9b
No known key found for this signature in database
GPG Key ID: 6BBED1B63A6D639F
1 changed files with 51 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
app/Model/Event.php
View File

@ -6299,21 +6299,13 @@ class Event extends AppModel
} else {
$failed_attributes++;
$lastAttributeError = $this->Attribute->validationErrors;
$original_uuid = $this->Object->Attribute->find(
'first',
array(
'conditions' => array(
'Attribute.event_id' => $id,
'Attribute.deleted' => 0,
'Attribute.type' => $attribute['type'],
'Attribute.value' => $attribute['value']
),
'recursive' => -1,
'fields' => array('Attribute.uuid')
)
$original_uuid = $this->__findOriginalUUID(
$attribute['type'],
$attribute['value'],
$id
);
if (!empty($original_uuid)) {
$recovered_uuids[$attribute['uuid']] = $original_uuid['Attribute']['uuid'];
$recovered_uuids[$attribute['uuid']] = $original_uuid;
} else {
$failed[] = $attribute['uuid'];
}
@ -6619,6 +6611,52 @@ class Event extends AppModel
return 0;
}
private function __findOriginalUUID($attribute_type, $attribute_value, $event_id)
{
$original_uuid = $this->Object->Attribute->find(
'first',
array(
'conditions' => array(
'Attribute.event_id' => $event_id,
'Attribute.deleted' => 0,
'Attribute.object_id' => 0,
'Attribute.type' => $attribute_type,
'Attribute.value' => $attribute_value
),
'recursive' => -1,
'fields' => array('Attribute.uuid')
)
);
if (!empty($original_uuid)) {
return ['Attribute']['uuid'];
}
$original_uuid = $this->Object->find(
'first',
array(
'conditions' => array(
'Attribute.event_id' => $event_id,
'Attribute.deleted' => 0,
'Attribute.type' => $attribute_type,
'Attribute.value1' => $attribute_value,
'Object.event_id' => $event_id
),
'recursive' => -1,
'fields' => array('Object.uuid'),
'joins' => array(
array(
'table' => 'attributes',
'alias' => 'Attribute',
'type' => 'inner',
'conditions' => array(
'Attribute.object_id = Object.id'
)
)
)
)
);
return (!empty($original_uuid)) ? $original_uuid['Object']['uuid'] : $original_uuid;
}
private function __saveObjectAttribute($attribute, $default_comment, $event_id, $object_id, $user)
{
$attribute['object_id'] = $object_id;