MISP / MISP/misp-modules

HIBP Enrichment Module returns "Array returned Array returned Array returned..." rather than actual results

Open
#691 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
377
Forks
280
Avg merge
2d 2h
Merged PRs (30d)
10

Description

We configured the Have I Been Pwdned enrichment module as we have an API key.

I have an e-mail address that I know is caught up in several compromises since it is ~26 years old. When I add this as an attribute on an Event, the hibp plugin does appear to run, but when we open the results we get the following:

image

The corresponding JSON data containing the list of breaches the address is associated with is as follows, when calling the same API endpoint using PostMan:

[
    {
        "Name": "AntiPublic"
    },
    {
        "Name": "ExploitIn"
    },
    {
        "Name": "LinkedIn"
    },
    {
        "Name": "LinkedInScrape"
    },
    {
        "Name": "OnlinerSpambot"
    },
    {
        "Name": "PDL"
    },
    {
        "Name": "Trillian"
    },
    {
        "Name": "VerificationsIO"
    },
    {
        "Name": "Zynga"
    }
]

I don't know if this is the result of changes on HIBP's end, or a general issue with the code as I am not that conversant in Python.

Can anyone help?

Regards,
JohnB

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the Have I Been Pwned enrichment module and tracing how its API response is converted into the displayed result. Compare that handling with the JSON response shown from Postman; done means the module presents the individual breach names instead of repeated “Array returned” text.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.