Merge branch '2.4' of github.com:MISP/MISP into 2.4

app/Lib/Export/OpendataExport.php

@@ -17,6 +17,8 @@ class OpendataExport
     private $__scripts_dir = APP . 'files/scripts/';
     private $__script_name = 'misp-opendata/opendata.py';
 
+    private $__request_object = [];
+
     public function setDefaultFilters($filters)
     {
         $this->__default_filters = $filters;
@@ -58,11 +60,7 @@ class OpendataExport
             $simple_query = true;
         }
         if (!empty($this->__default_filters['portal-url'])) {
-            if ($simple_query) {
-                $this->__url = ' --portal_url ' . $this->__default_filters['portal-url'];
-            } else {
-                $this->__url .= ' --portal_url ' . $this->__default_filters['portal-url'];
-            }
+            $this->__request_object['portal_url'] = $this->__default_filters['portal-url'];
             unset($this->__default_filters['portal-url']);
         }
         return '';
@@ -73,7 +71,7 @@ class OpendataExport
         $my_server = ClassRegistry::init('Server');
         $cmd = $my_server->getPythonVersion() . ' ' . $this->__scripts_dir . $this->__script_name;
         if (!empty($this->__auth)) {
-            $cmd .= ' --auth ' . $this->__auth;
+            $this->__request_object['auth'] = $this->__auth;
         }
         if ($this->__search){
             return $this->__search_query($cmd);
@@ -91,14 +89,15 @@ class OpendataExport
         unset($this->__default_filters['returnFormat']);
         $body = json_encode($this->__default_filters);
         $bodyFilename = $this->__generateSetupFile($body);
-        $bodyParam = ' --body ' . $bodyFilename;
-        $levelParam = ' --level ' . strtolower($this->__scope) . 's';
+        $this->__request_object['body'] = $bodyFilename;
+        $this->__request_object['level'] = strtolower($this->__scope) . 's';
         $setup = json_encode($this->__setup);
         $setupFilename = $this->__generateSetupFile($setup);
-        $setupParam = ' --setup ' . $setupFilename;
-        $urlParam = ' --misp_url ' . $this->__url;
-        $cmd .= $bodyParam . $setupParam . $levelParam . $urlParam;
-        $results = shell_exec($cmd);
+        $this->__request_object['setup'] = $setupFilename;
+        $this->__request_object['misp_url'] = $this->__url;
+        $commandFile = $this->__generateCommandFile();
+        $results = shell_exec($cmd . ' --query_data ' . $commandFile);
+        unlink($commandFile);
         unlink($bodyFilename);
         unlink($setupFilename);
         return $results;
@@ -120,28 +119,25 @@ class OpendataExport
 
     private function __delete_query($cmd)
     {
-        $cmd .= $this->__url . " -d '" . $this->__setup['dataset'] . "'";
+        $this->__request_object['delete'] = $this->__setup['dataset'];
         return $this->__simple_query($cmd);
     }
 
     private function __search_query($cmd)
     {
-        $cmd .= $this->__url . " -s '" . $this->__setup['dataset'] . "'";
+        $this->__request_object['search'] = $this->__setup['dataset'];
         return $this->__simple_query($cmd);
     }
 
     private function __simple_query($cmd)
     {
         if (!empty($this->__setup['resources'])) {
-            if (is_array($this->__setup['resources'])) {
-                foreach ($this->__setup['resources'] as $resource) {
-                    $cmd .= " '" . $resource . "'";
-                }
-            } else {
-                $cmd .= " '" . $this->__setup['resources'] . "'";
-            }
+            $this->__request_object['search'] = $this->__setup['resources'];
         }
-        return shell_exec($cmd);
+        $commandFile = $this->__generateCommandFile();
+        $results = shell_exec($cmd . ' --query_data ' . $commandFile);
+        unlink($commandFile);
+        return $results;
     }
 
     private function __generateRandomFileName()
@@ -157,4 +153,13 @@ class OpendataExport
         $tmpFile->close();
         return $filename;
     }
+
+    private function __generateCommandFile()
+    {
+        $filename = $this->__scripts_dir . 'tmp/' . $this->__generateRandomFileName() . '.command';
+        $tmpFile = new File($filename, true, 0644);
+        $tmpFile->write(json_encode($this->__request_object));
+        $tmpFile->close();
+        return $filename;
+    }
 }

app/Lib/Tools/ComplexTypeTool.php

@@ -3,7 +3,7 @@ require_once __DIR__ . '/TmpFileTool.php';
 
 class ComplexTypeTool
 {
-    private const REFANG_REGEX__TABLE = array(
+    const REFANG_REGEX__TABLE = array(
         array(
             'from' => '/^(hxxp|hxtp|htxp|meow|h\[tt\]p)/i',
             'to' => 'http',

app/Model/AttachmentScan.php

@@ -22,7 +22,7 @@ class AttachmentScan extends AppModel
      * List of supported object templates
      * @var string[]
      */
-    private const SIGNATURE_TEMPLATES = [
+    const SIGNATURE_TEMPLATES = [
         '4dbb56ef-4763-4c97-8696-a2bfc305cf8e', // av-signature
         '984c5c39-be7f-4e1e-b034-d3213bac51cb', // sb-signature
     ];

app/Model/Attribute.php

@@ -83,10 +83,10 @@ class Attribute extends AppModel
     // e.g. if the attribute should be correlated with others or not
 
     // if these then a category may have upload to be zipped
-    public const ZIPPED_DEFINITION = ['malware-sample'];
+    const ZIPPED_DEFINITION = ['malware-sample'];
 
     // if these then a category may have upload
-    public const UPLOAD_DEFINITIONS = ['attachment'];
+    const UPLOAD_DEFINITIONS = ['attachment'];
 
     // skip Correlation for the following types
     public $nonCorrelatingTypes = array(
@@ -102,7 +102,7 @@ class Attribute extends AppModel
             'anonymised'
     );
 
-    public const PRIMARY_ONLY_CORRELATING_TYPES = array(
+    const PRIMARY_ONLY_CORRELATING_TYPES = array(
         'ip-src|port',
         'ip-dst|port',
         'hostname|port',
@@ -754,7 +754,7 @@ class Attribute extends AppModel
         return true;
     }
 
-    private const HEX_HAS_LENGTHS = array(
+    const HEX_HAS_LENGTHS = array(
         'authentihash' => 64,
         'md5' => 32,
         'imphash' => 32,

app/Model/Behavior/AuditLogBehavior.php

@@ -16,7 +16,7 @@ class AuditLogBehavior extends ModelBehavior
     private $enabled;
 
     // Hash is faster that in_array
-    private const SKIP_FIELDS = [
+    const SKIP_FIELDS = [
         'id' => true,
         'lastpushedid' => true,
         'timestamp' => true,

app/Model/Feed.php

@@ -61,7 +61,7 @@ class Feed extends AppModel
         )
     );
 
-    public const DEFAULT_FEED_PULL_RULES = [
+    const DEFAULT_FEED_PULL_RULES = [
         'tags' => [
             "OR" => [],
             "NOT" => [],

app/View/Elements/GalaxyClusters/view_relation_tree.ctp

@@ -299,7 +299,7 @@ $randomClass = "relation-{$random}";
             .attr("class", "well well-small")
             .style('padding', '4px 9px')
             .style('white-space', 'nowrap')
-            .html(function(d) { return d.Relation.referenced_galaxy_cluster_type; })
+            .text(function(d) { return d.Relation.referenced_galaxy_cluster_type; })
             
         paddingX = 8;
         gEnter.append("foreignObject")
@@ -319,7 +319,7 @@ $randomClass = "relation-{$random}";
                             .style('background-color', tag.colour)
                             .style('color', getTextColour(tag.colour))
                             .style('display', 'inline')
-                            .html(tag.name)
+                            .text(tag.name)
                     });
                 }
             });

app/View/GalaxyElements/ajax/index.ctp

@@ -83,7 +83,7 @@ if ($context == 'JSONView') {
 
 echo $this->element('/genericElements/IndexTable/index_table', $indexOptions);
 if ($context == 'JSONView') {
-    echo sprintf('<div id="elementJSONDiv" class="well well-small">%s</div>', json_encode($JSONElements));
+    echo sprintf('<div id="elementJSONDiv" class="well well-small">%s</div>', json_encode(h($JSONElements)));
 }
 ?>
 

app/files/scripts/misp-opendata

@@ -1 +1 @@
-Subproject commit ecc3b4580d5a050479ae3b404f5492b55e8efe82
+Subproject commit f06333e3e834e37a8efe3d24105b51797ccc5a6c