#1376 Fix tag parsing

TheHive-Project · Jun 13, 2020 · 8037795 · 8037795
1 parent fba9506
commit 8037795
Show file tree

Hide file tree

Showing 3 changed files with 37 additions and 7 deletions.
diff --git a/ScalliGraph b/ScalliGraph
diff --git a/thehive/app/org/thp/thehive/models/Tag.scala b/thehive/app/org/thp/thehive/models/Tag.scala
@@ -36,7 +36,7 @@ object Tag {
   val namespacePredicateValueColour: Regex = "([^\".:=]+)[.:]([\".=]+)=\"([^\"]+)\"#(\\p{XDigit}{6})".r
   val namespacePredicateValue: Regex       = "([^\".:=]+)[.:]([^\".=]+)=\"?([^\"]+)\"?".r
   val namespacePredicate: Regex            = "([^\".:=]+)[.:]([^\".=]+)".r
-  val PredicateValue: Regex                = "([^\".:=]+)=\"([^\"]+)\"".r
+  val PredicateValue: Regex                = "([^\".:=]+)[=:]\"?([^\"]+)\"?".r
   val predicate: Regex                     = "([^\".:=]+)".r
 
   def fromString(tagName: String, defaultNamespace: String, defaultColour: Int = 0): Tag = {
@@ -45,11 +45,12 @@ object Tag {
       case Array(n)    => n -> defaultColour
     }
     name match {
-      case namespacePredicateValue(namespace, predicate, value) => Tag(namespace, predicate, Some(value), None, colour)
-      case namespacePredicate(namespace, predicate)             => Tag(namespace, predicate, None, None, colour)
-      case PredicateValue(predicate, value)                     => Tag(defaultNamespace, predicate, Some(value), None, colour)
-      case predicate(predicate)                                 => Tag(defaultNamespace, predicate, None, None, colour)
-      case _                                                    => Tag(defaultNamespace, name, None, None, colour)
+      case namespacePredicateValue(namespace, predicate, value) if value.exists(_ != '=') =>
+        Tag(namespace.trim, predicate.trim, Some(value.trim), None, colour)
+      case namespacePredicate(namespace, predicate) => Tag(namespace.trim, predicate.trim, None, None, colour)
+      case PredicateValue(predicate, value)         => Tag(defaultNamespace, predicate.trim, Some(value.trim), None, colour)
+      case predicate(predicate)                     => Tag(defaultNamespace, predicate.trim, None, None, colour)
+      case _                                        => Tag(defaultNamespace, name, None, None, colour)
     }
   }
 }
diff --git a/thehive/test/org/thp/thehive/models/TagTest.scala b/thehive/test/org/thp/thehive/models/TagTest.scala
@@ -0,0 +1,29 @@
+package org.thp.thehive.models
+
+import play.api.test.PlaySpecification
+
+class TagTest extends PlaySpecification {
+  val defaultNamespace: String = "_default_namespace_"
+  val defaultColor: Int        = 0xffff00
+
+  def parseTag(s: String): Tag = Tag.fromString(s, defaultNamespace, defaultColor)
+  "tag" should {
+    "be parsed from key:value" in {
+      val tag = parseTag("Id:7SeUoB3IBABD+tMh2PjVJYg==")
+      tag must beEqualTo(Tag(defaultNamespace, "Id", Some("7SeUoB3IBABD+tMh2PjVJYg=="), None, defaultColor))
+      tag.toString must beEqualTo("Id=\"7SeUoB3IBABD+tMh2PjVJYg==\"")
+    }
+
+    "be parsed from key: value" in {
+      val tag = parseTag("domain: google.com")
+      tag must beEqualTo(Tag(defaultNamespace, "domain", Some("google.com"), None, defaultColor))
+      tag.toString must beEqualTo("domain=\"google.com\"")
+    }
+
+    "be parsed from key: a.b.c.d" in {
+      val tag = parseTag("ip: 8.8.8.8")
+      tag must beEqualTo(Tag(defaultNamespace, "ip", Some("8.8.8.8"), None, defaultColor))
+      tag.toString must beEqualTo("ip=\"8.8.8.8\"")
+    }
+  }
+}
+24 −24		build.sbt
+21 −18		core-test/src/test/scala/org/thp/scalligraph/models/Modern.scala
+1 −1		core-test/src/test/scala/org/thp/scalligraph/models/PerformanceTest.scala
+4 −1		core-test/src/test/scala/org/thp/scalligraph/services/DedupTest.scala
+4 −1		core/src/main/scala/org/thp/scalligraph/models/Database.scala
+14 −11		core/src/main/scala/org/thp/scalligraph/models/Operation.scala
+5 −0		core/src/main/scala/org/thp/scalligraph/models/Schema.scala
+44 −14		core/src/main/scala/org/thp/scalligraph/services/DedupActor.scala
+86 −33		database/janusgraph/src/main/scala/org/thp/scalligraph/janus/JanusDatabase.scala
+2 −2		project/Dependencies.scala