MISP / MISP/PyMISP

Clarify Errors for Large Event Reports

Open
#846 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
491
Forks
290
Avg merge
2d 8h
Merged PRs (30d)
3

Description

When using api.add_event_report(), I get two errors.

  1. When a MISPEvent is provided, api.get_uuid_or_id_from_abstract_misp() returns the UUID, but the add_event_report() for the event value must be the MISPEvent['id'] integer or string.
  2. If the content value is larger than the database maximum (MySQL text max is 64k), the error provided is not useful.

Error 1:

Something went wrong (403): {'saved': False, 'name': 'Could not add EventReport', 'message': 'Could not add EventReport', 'url': '/event_reports/add', 'errors': 'numeric'}
{'errors': (403, {'saved': False, 'name': 'Could not add EventReport', 'message': 'Could not add EventReport', 'url': '/event_reports/add', 'errors': 'numeric'})}

Error 2:

Unknown error: the response is not in JSON.
Something is broken server-side, please send us everything that follows (careful with the auth key):
# content truncated with 100k content value
Response (if any):
{"name":"An Internal Error Has Occurred.","message":"An Internal Error Has Occurred.","url":"\/eventReports\/add\/1234"}
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "python3.10/site-packages/pymisp/api.py", line 486, in add_event_report
    new_event_report = self._check_json_response(r)
  File "python3.10/site-packages/pymisp/api.py", line 3497, in _check_json_response
    r = self._check_response(response, expect_json=True)
  File "python3.10/site-packages/pymisp/api.py", line 3514, in _check_response
    raise MISPServerError(f'Error code 500:\n{response.text}')
pymisp.exceptions.MISPServerError: Error code 500:
{"name":"An Internal Error Has Occurred.","message":"An Internal Error Has Occurred.","url":"\/eventReports\/add\/1234"}

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in pymisp/api.py at add_event_report(), then follow _check_json_response() and _check_response() to understand the current error paths. Reproduce both cases from the issue: a MISPEvent passed as the event value and content exceeding the database limit. Done means the event identifier is accepted correctly and oversized content produces a useful, actionable error.

Written by the indexing model from the issue text.

Assessment

Tech stack
mysql, python
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.