corelight / corelight/ecs-templates

python script issues

Open Beginner friendly
#32 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
9
Forks
7
PR merge metrics
No merged PRs in 30d

Description

While troubleshooting, I found two bugs in the python script:
---
https://github.com/corelight/ecs-templates/blob/ee66f7408971f8194e81c31a74d05f4cff5b31bb/corelight_ecs.py#L845-L846
If you input 'ingest', then this variable will not be set to True here, although 'ingest' and 'i' are supposed to be the same. This might not be much of a problem, as the script seems to be working, but might be unexpected behaviour.

---

https://github.com/corelight/ecs-templates/blob/ee66f7408971f8194e81c31a74d05f4cff5b31bb/corelight_ecs.py#L303-L309
The last three lines should not be indented below the with statement. This breaks the os.remove( filename ) line on Windows. The indentation for all three lines should be reduced by 1 like so:
```
with zipfile.ZipFile( filename, 'r' ) as zip_ref:
unzip_name = zip_ref.namelist()[ 0 ]
zip_ref.extractall( Temp_Output_Dir )
shutil.move( os.path.join( Temp_Output_Dir, unzip_name ), os.path.join( git_unzip_dir_name ) )
os.remove( filename )
logger.debug(f"Successfully unzipped and removed Git file {fname} to: {git_unzip_dir_name}")
return git_unzip_dir_name
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Open corelight_ecs.py at lines 845-846 and 303-309. Check how the script handles the equivalent 'ingest' and 'i' inputs, then inspect the Git archive extraction flow and its indentation. Done means both inputs set the expected state and Windows can remove the downloaded file after extraction without changing the reported behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
tooling
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.