PyMISP icon indicating copy to clipboard operation
PyMISP copied to clipboard

Can't untag numeric tag name (str('1')) from an event

Open aaronkaplan opened this issue 1 year ago • 2 comments

If you tag an event with a numeric tag name (let's say the string '1'), then it's impossible to misp.untag(...) it again from an event.

See line:

     response = self._prepare_request('POST', 'tags/removeTagFromObject', data=to_post)

It's probably connected to the way the data is processed in MISP and not really a PyMISP issue. Maybe there is a work-around in PyMISP (?)

And indeed, in MISP the bug is here: https://github.com/MISP/MISP/blob/c3221af12e664daf501afeef0a658fb11e018f58/app/Controller/TagsController.php#L876

aaronkaplan avatar Jul 29 '24 21:07 aaronkaplan

I don't think there is a way to escape the string so the tag is removed instead of being converted to an int. @iglocska @mokaddem @righel if you have an idea?

Rafiot avatar Jul 30 '24 09:07 Rafiot

Yeah, I was afraid of that. The web serivce just gets data and decides if it should be interpreted as int() first or not...

aaronkaplan avatar Jul 30 '24 09:07 aaronkaplan