opencti icon indicating copy to clipboard operation
opencti copied to clipboard

[backend] validate elUpdateElement input value against schema before indexing (#5696)

Open labo-flg opened this issue 1 year ago • 3 comments

Proposed changes

  • insert a validation step at the start of engine elUpdateElement function
  • validate the payload before indexing, against the schema

Related issues

  • #5696

labo-flg avatar Feb 20 '24 09:02 labo-flg

Codecov Report

Attention: Patch coverage is 91.91919% with 8 lines in your changes are missing coverage. Please review.

Project coverage is 66.71%. Comparing base (d793a45) to head (ba1f957). Report is 1 commits behind head on master.

Files Patch % Lines
...orm/opencti-graphql/src/schema/schema-validator.ts 40.00% 3 Missing :warning:
...rm/opencti-graphql/src/schema/schema-attributes.ts 97.56% 2 Missing :warning:
...ncti-platform/opencti-graphql/src/types/store.d.ts 0.00% 2 Missing :warning:
...orm/opencti-graphql/src/domain/stixDomainObject.js 0.00% 1 Missing :warning:
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #6046      +/-   ##
==========================================
+ Coverage   66.67%   66.71%   +0.04%     
==========================================
  Files         541      541              
  Lines       64420    64501      +81     
  Branches     5256     5288      +32     
==========================================
+ Hits        42950    43033      +83     
+ Misses      21470    21468       -2     

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

codecov[bot] avatar Feb 23 '24 09:02 codecov[bot]

This seems like a valid input yes. I'll investigate to see how it comes this payload is produced. If it's a valid payload, it's a bug on the validation process. Otherwise... Maybe we do not handle objectpath on multiple like that (only on indexed path).

labo-flg avatar Feb 26 '24 16:02 labo-flg

I've pushed a commit to allow such case @lndrtrbn, and added some integration tests.

labo-flg avatar Feb 26 '24 17:02 labo-flg