MISP / MISP/misp-modules

assemblyline_submit: KeyError: 'submission'

Open
#657 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
377
Forks
280
Avg merge
2d 2h
Merged PRs (30d)
10

Description

I am trying to set up the assemblyline_submit module as packaged with the misp-docker deployment.

After configuration, when I attempt to a URL for enrichment, I receive the error: "Something went wrong, look in the server logs for details"

Looking at the logs of the misp-modules container, I see:

2024-03-10 23:18:03,800 - misp-modules - ERROR - Something went wrong when processing query request
Traceback (most recent call last):
  File "/usr/local/lib/python3.11/site-packages/misp_modules/__init__.py", line 223, in post
    response = yield tornado.gen.with_timeout(timeout, future)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/tornado/gen.py", line 769, in run
    value = future.result()
            ^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/concurrent/futures/thread.py", line 58, in run
    result = self.fn(*self.args, **self.kwargs)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/misp_modules/__init__.py", line 210, in run_request
    response = module.handler(q=json_payload)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.11/site-packages/misp_modules/modules/expansion/assemblyline_submit.py", line 73, in handler
    sid = submission['submission']['sid']
          ~~~~~~~~~~^^^^^^^^^^^^^^
KeyError: 'submission'

Running the same command manually using the latest version of the assemblyline_client (https://cybercentrecanada.github.io/assemblyline4_docs/integration/python/#submit), there is no "submission" key. "sid" is a key of the submission result itself, so line 73 should just be sid = submission['sid'], I think.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in misp_modules/modules/expansion/assemblyline_submit.py at the handler line shown in the traceback, and compare its submission response handling with the Assemblyline client documentation linked in the issue. Reproduce the URL enrichment request and confirm that the returned sid is handled without a KeyError.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.