MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

chg: [correlations] Really limit number of correlations, not number of attributes

pull/6357/head
Jakub Onderka 2020-09-28 19:52:19 +02:00
parent d1eec44d8d
commit 95dfd75af7
2 changed files with 18 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
app/Model/Feed.php
View File

@ -331,7 +331,7 @@ class Feed extends AppModel
* @param array $attributes
* @param array $user
* @param array $event
* @param bool $overrideLimit Override hardcoded limit for 10 000 attribute correlations.
* @param bool $overrideLimit Override hardcoded limit for 10 000 correlations.
* @param string $scope `Feed` or `Server`
* @return array
*/
@ -398,20 +398,6 @@ class Feed extends AppModel
$results = $pipe->exec();
if (!$overrideLimit && count($attributes) > 10000) {
foreach ($results as $k => $result) {
if ($result) {
if (isset($event['FeedCount'])) {
$event['FeedCount']++;
} else {
$event['FeedCount'] = 1;
}
$attributes[$redisResultToAttributePosition[$k]]['FeedHit'] = true;
}
}
return $attributes;
}
$hitIds = [];
foreach ($results as $k => $result) {
if ($result) {
@ -423,6 +409,15 @@ class Feed extends AppModel
return $attributes; // nothing matches, skip
}
$hitCount = count($hitIds);
if (!$overrideLimit && $hitCount > 10000) {
$event['FeedCount'] = $hitCount;
foreach ($hitIds as $k) {
$attributes[$redisResultToAttributePosition[$k]]['FeedHit'] = true;
}
return $attributes;
}
$sources = $this->getCachedFeedsOrServers($user, $scope);
foreach ($sources as $source) {
$sourceId = $source[$scope]['id'];

11
app/View/Events/view.ctp
View File

@ -380,15 +380,20 @@
<div class="correlation-container">
<?php
foreach ($event['Feed'] as $relatedFeed):
$relatedData = array('Name' => $relatedFeed['name'], 'URL' => $relatedFeed['url'], 'Provider' => $relatedFeed['provider'], 'Source Format' => $relatedFeed['source_format'] == 'misp' ? 'MISP' : $relatedFeed['source_format']);
$relatedData = array(
'Name' => $relatedFeed['name'],
'URL' => $relatedFeed['url'],
'Provider' => $relatedFeed['provider'],
'Source Format' => $relatedFeed['source_format'] === 'misp' ? 'MISP' : $relatedFeed['source_format'],
);
$popover = '';
foreach ($relatedData as $k => $v) {
$popover .= '<span class=\'bold\'>' . h($k) . '</span>: <span class="blue">' . h($v) . '</span><br />';
$popover .= '<span class="bold">' . h($k) . '</span>: <span class="blue">' . h($v) . '</span><br>';
}
?>
<span style="white-space: nowrap;">
<?php
if ($relatedFeed ['source_format'] == 'misp'):
if ($relatedFeed ['source_format'] === 'misp'):
?>
<form action="<?php echo $baseurl; ?>/feeds/previewIndex/<?php echo h($relatedFeed['id']); ?>" method="post" style="margin:0px;">
<input type="hidden" name="data[Feed][eventid]" value="<?php echo h(json_encode($relatedFeed['event_uuids'], true)); ?>">