intelmq icon indicating copy to clipboard operation
intelmq copied to clipboard

Modify bot: skip rule for type mismatch

Open ghost opened this issue 6 years ago • 4 comments

Reported by @kalyparker in https://github.com/certtools/intelmq/issues/1426#issue-471841615

And finally I spotted a mistake in the actual bot, which execute the "then" when things do not match. missing "return None" ;)

else:
    self.logger.warn("Type of rule (%r) and data (%r) do not "
                               "match in %s, %s!",
                                type(rule), type(event[name]), identifier, name)
    return None

ghost avatar Jul 31 '19 12:07 ghost

I think that was actually intentional, but can be changed of course.

Is a type mismatch just a non-matching rule or is it an error?

ghost avatar Jul 31 '19 12:07 ghost

Error or not, when you have multiple condition in the "if", you execute the code because this part is considered as true. I don't see a good reason for that, but maybe there is ?

kalyparker avatar Jul 31 '19 19:07 kalyparker

With 0ab28467e20be2fcaf3ae68fae002a3524269b3a (June 2019) this particular code has been rewritten. There have been some other changes to the bot since then as well. Therefore, the discussed code does not exist anymore. For all non-regex comparisons, the bot now performs a simple != operation. Can you please check if your concerns still apply?

ghost avatar Feb 05 '21 15:02 ghost

Clearing the milestone as it's unclear if there is anything to do.

ghost avatar Feb 19 '21 15:02 ghost