HybridAnalysis analyzer does not properly handle filenames on some cases

[srilumpa]

Request Type

Bug

Work Environment

(replace with N/A if not applicable)

Question	Answer
OS version (server)	Debian
Cortex Analyzer Name	HybridAnalysis
Cortex Analyzer Version	1.0
Cortex Version	2.0.4

Description

This is a follow up of TheHive-Project/TheHive#530.

On some cases, the HybridAnalys_GetReport analyzer fails when applied on a filename. I think this happens when the filename contains a ' character.

Steps to Reproduce

1. submit analysis of a filename containing a "'"

Complementary information

Here is one result of this kind of analysis:

{
  "errorMessage": "Phrase 'srilumpa's file' should be in double quote.",
  "input": "{\"tlp\":2,\"parameters\":{},\"dataType\":\"filename\",\"config\":{\"check_tlp\":true,\"proxy_https\":null,\"max_tlp\":2,\"auto_extract_artifacts\":false,\"secret\":\"[REDACTED]\",\"proxy_http\":null,\"key\":\"REMOVED\"},\"message\":\"\",\"data\":\"srilumpa's file\"}",
  "success": false
}

[srilumpa]

In fact, it seems more generic than that. Example below:

{
  "errorMessage": "Phrase 'DHL ITALY - Intraship Shipment Notification.bat' should be in double quote.",
  "input": "{\"tlp\":2,\"parameters\":{},\"dataType\":\"filename\",\"config\":{\"check_tlp\":true,\"proxy_https\":null,\"max_tlp\":2,\"auto_extract_artifacts\":false,\"secret\":\"[REDACTED]\",\"proxy_http\":null,\"key\":\"REMOVED\"},\"message\":\"41907\",\"data\":\"DHL ITALY - Intraship Shipment Notification.bat\"}",
  "success": false
}

[3c7]

Will look into it, but right now it's too hot to do anything. :D

[3c7]

Sorry, I forgot about this. :/ Fixed now.