PyMISP icon indicating copy to clipboard operation
PyMISP copied to clipboard

Clarify Errors for Large Event Reports

Open malvidin opened this issue 1 year ago • 2 comments

When using api.add_event_report(), I get two errors.

  1. When a MISPEvent is provided, api.get_uuid_or_id_from_abstract_misp() returns the UUID, but the add_event_report() for the event value must be the MISPEvent['id'] integer or string.
  2. If the content value is larger than the database maximum (MySQL text max is 64k), the error provided is not useful.

Error 1:

Something went wrong (403): {'saved': False, 'name': 'Could not add EventReport', 'message': 'Could not add EventReport', 'url': '/event_reports/add', 'errors': 'numeric'}
{'errors': (403, {'saved': False, 'name': 'Could not add EventReport', 'message': 'Could not add EventReport', 'url': '/event_reports/add', 'errors': 'numeric'})}

Error 2:

Unknown error: the response is not in JSON.
Something is broken server-side, please send us everything that follows (careful with the auth key):
# content truncated with 100k content value
Response (if any):
{"name":"An Internal Error Has Occurred.","message":"An Internal Error Has Occurred.","url":"\/eventReports\/add\/1234"}
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "python3.10/site-packages/pymisp/api.py", line 486, in add_event_report
    new_event_report = self._check_json_response(r)
  File "python3.10/site-packages/pymisp/api.py", line 3497, in _check_json_response
    r = self._check_response(response, expect_json=True)
  File "python3.10/site-packages/pymisp/api.py", line 3514, in _check_response
    raise MISPServerError(f'Error code 500:\n{response.text}')
pymisp.exceptions.MISPServerError: Error code 500:
{"name":"An Internal Error Has Occurred.","message":"An Internal Error Has Occurred.","url":"\/eventReports\/add\/1234"}

malvidin avatar Jul 12 '22 08:07 malvidin

  1. That sounds like a bug. @mokaddem is there a reason POST on eventReports/add/<id> only works with an event ID? It should also work with an event UUID (I think?).
  2. This should probably not raise an internal error. @mokaddem @iglocska @righel is there something that can be done on MISP side?

Rafiot avatar Jul 12 '22 09:07 Rafiot

Just bumped into the first error. @iglocska @Rafiot this happens with MISP and pyMISP 165.

ostefano avatar Nov 25 '22 15:11 ostefano