Incorrect tag filter results when observables with tags are added then deleted

[DarrenSykes]

Problem Description

When an observable is removed from a case, filtering on a tag that belongs/ed to that observable still returns the case in search results.

Steps to Reproduce

1. Create 2 cases
2. Add the same tag to an observable in both cases
3. Delete one of the observables
4. On the case page, filter based on the tag

You should see only one case, but both are displayed

Possible Solutions

1. Delete objects rather than updating an attribute to indicate they're deleted*
2. Modify the search filter to exclude deleted observables

*This would resolve another bug, whereby webhooks are not fired whenever an observables that has previously been deleted is re-added to a case.

Complementary information

[ITServ-DE]

I try to reproduce your problem, but I cant.

Could you please describe step 4 more in detail? When I activate filters on the case page, they filter on the tags of the case, not on the tags of the case's observables.

Thank you.

[nadouani]

Filtering cases by tag, doesn't rely on observable tags, but only on case tags. So this is expected

[DarrenSykes]

I have some example cases that demonstrate a problem with tag filtering.

However, the tags are too identifiable for my business. Happy to share a screenshot/data privately to demonstrate.

[nadouani]

Please if you feel this is a real issue, we will be happy to reopen the issue and fix it. But from what I understood from the issue description, there is a confusion between case tags and observable tags.

If you have more details, please share them.

[DarrenSykes]

I misdiagnosed the problem, but believe there is still an issue.

Try this:

Create a tag on a case called 'test="one two three"
Create another tag on a different case called 'test="three four five"

Filtering on either tag (and you'll get both cases)

[ITServ-DE]

Can't confirm, at least not for TH 3.4.0-RC1

I added the tag one two three to case 1, and three four five. The number three is included in both tags.

When I'm in the case list and filter for the tag one, I get nothing back. Same for two, three, four and five.

Only if I filter on one two three or three four five, I get exactly one record back. Works to me as expected, because TH (obvisiously) searches on entire tags, not part of tags.

Here my Screenshots:

[nadouani]

Ok, so this in fact happens in the cases list that rely on the _string query operator.

As a workaround, you can use the search page which is more strict.

This will be fixed.

Note that what breaks things, is the use of "

[ITServ-DE]

I just recognized you tagged with test=one two three and test=three four five.

I have repeated the above test, with the same result. If I filter for a tag named one, I get not results. The same happens if I filter for the tag test=

[nadouani]

The " are not escaped, that's the issue. If you search for test=\"one two three\" is works. So this has to be fixed.

[z00z004242]

Hi everyone.

Does the fix also patches an XSS issue ?