Error when uploading password protected zips as observables

[Spiderstryder]

Error when uploading password protected zips as observables)

Request Type

Bug

Work Environment

Question	Answer
OS version (server)	GKE-optimized ubuntu
OS version (client)	Windows
TheHive version / git hash	3.1.2
Package Type	Docker
Browser type & version	Chrome

Problem Description

When uploading zips and providing a password to the archive, the observables list refuses to display anything (shows (0 of X)).

Steps to Reproduce

Upload a zip with some malware payload,#
Tick it's an archive,
add password,
watch everything explode.

Complementary information

console error log:
  "org.elastic4play.InternalError: Artifact has invalid data : {"createdBy":"stryder","dataType":"file","sighted":false,"createdAt":1543338138910,"message":"","startDate":1543338138913,"ioc":true,"tags":["anyrun"],"reports":"{}","tlp":2,"status":"Ok","attachment":{"name":"RECHNUNG.doc","hashes":["97c692c26ed8c0b79b4748a8e27c3451a6ff97f141798fd004ecc02629424ba4","d6be85221f93e7f62b22ac5d49d7868d8978a13a","4c2fab380f8c7651ccdff738d49e6702"],"size":84736,"contentType":null,"id":"97c692c26ed8c0b79b4748a8e27c3451a6ff97f141798fd004ecc02629424ba4"},"_type":"case_artifact","_routing":"AWdWHhtW2jQ6vlWSRW8w","_parent":"AWdWHhtW2jQ6vlWSRW8w","_id":"a5dbcef7197cc7b88c16a37924b95f0a","_version":1}
	at connectors.cortex.services.CortexAnalyzerSrv.$anonfun$submitJob$9(CortexAnalyzerSrv.scala:317)
	at scala.util.Success.$anonfun$map$1(Try.scala:251)
	at scala.util.Success.map(Try.scala:209)
	at scala.concurrent.Future.$anonfun$map$1(Future.scala:288)
	at scala.concurrent.impl.Promise.liftedTree1$1(Promise.scala:29)
	at scala.concurrent.impl.Promise.$anonfun$transform$1(Promise.scala:29)
	at scala.concurrent.impl.CallbackRunnable.run(Promise.scala:60)
	at akka.dispatch.BatchingExecutor$AbstractBatch.processBatch(BatchingExecutor.scala:55)
	at akka.dispatch.BatchingExecutor$BlockableBatch.$anonfun$run$1(BatchingExecutor.scala:91)
	at scala.runtime.java8.JFunction0$mcV$sp.apply(JFunction0$mcV$sp.java:12)
"  
 timestamp:  "2018-11-27T17:03:06Z"

net::ERR_CONNECTION_RESET 200 (OK)
(anonymous) @ vendor.3f801dae.js:6
q @ vendor.3f801dae.js:6
i @ vendor.3f801dae.js:6
g @ vendor.3f801dae.js:6
(anonymous) @ vendor.3f801dae.js:6
$eval @ vendor.3f801dae.js:6
$digest @ vendor.3f801dae.js:6
$apply @ vendor.3f801dae.js:6
i @ vendor.3f801dae.js:6
u @ vendor.3f801dae.js:6
x.onload @ vendor.3f801dae.js:6
load (async)
(anonymous) @ vendor.3f801dae.js:6
q @ vendor.3f801dae.js:6
i @ vendor.3f801dae.js:6
g @ vendor.3f801dae.js:6
(anonymous) @ vendor.3f801dae.js:6
$eval @ vendor.3f801dae.js:6
$digest @ vendor.3f801dae.js:6
$apply @ vendor.3f801dae.js:6
i @ vendor.3f801dae.js:6
u @ vendor.3f801dae.js:6
x.onload @ vendor.3f801dae.js:6
load (async)
(anonymous) @ vendor.3f801dae.js:6
q @ vendor.3f801dae.js:6
i @ vendor.3f801dae.js:6
g @ vendor.3f801dae.js:6
(anonymous) @ vendor.3f801dae.js:6
$eval @ vendor.3f801dae.js:6
$digest @ vendor.3f801dae.js:6
$apply @ vendor.3f801dae.js:6
i @ vendor.3f801dae.js:6
u @ vendor.3f801dae.js:6
x.onload @ vendor.3f801dae.js:6

TypeError: Cannot read property 'type' of null
    at scripts.499bcac5.js:6
    at vendor.3f801dae.js:6
    at g (vendor.3f801dae.js:6)
    at vendor.3f801dae.js:6
    at o.$eval (vendor.3f801dae.js:6)
    at o.$digest (vendor.3f801dae.js:6)
    at o.$apply (vendor.3f801dae.js:6)
    at i (vendor.3f801dae.js:6)
    at u (vendor.3f801dae.js:6)
    at XMLHttpRequest.y (vendor.3f801dae.js:6)
(anonymous) @ vendor.3f801dae.js:6
(anonymous) @ vendor.3f801dae.js:5
g @ vendor.3f801dae.js:6
(anonymous) @ vendor.3f801dae.js:6
$eval @ vendor.3f801dae.js:6
$digest @ vendor.3f801dae.js:6
$apply @ vendor.3f801dae.js:6
i @ vendor.3f801dae.js:6
u @ vendor.3f801dae.js:6
y @ vendor.3f801dae.js:6
error (async)
(anonymous) @ vendor.3f801dae.js:6
q @ vendor.3f801dae.js:6
i @ vendor.3f801dae.js:6
g @ vendor.3f801dae.js:6
(anonymous) @ vendor.3f801dae.js:6
$eval @ vendor.3f801dae.js:6
$digest @ vendor.3f801dae.js:6
$apply @ vendor.3f801dae.js:6
i @ vendor.3f801dae.js:6
u @ vendor.3f801dae.js:6
x.onload @ vendor.3f801dae.js:6
load (async)
(anonymous) @ vendor.3f801dae.js:6
q @ vendor.3f801dae.js:6
i @ vendor.3f801dae.js:6
g @ vendor.3f801dae.js:6
(anonymous) @ vendor.3f801dae.js:6
$eval @ vendor.3f801dae.js:6
$digest @ vendor.3f801dae.js:6
$apply @ vendor.3f801dae.js:6
i @ vendor.3f801dae.js:6
u @ vendor.3f801dae.js:6
x.onload @ vendor.3f801dae.js:6
load (async)
(anonymous) @ vendor.3f801dae.js:6
q @ vendor.3f801dae.js:6
i @ vendor.3f801dae.js:6
g @ vendor.3f801dae.js:6
(anonymous) @ vendor.3f801dae.js:6
$eval @ vendor.3f801dae.js:6
$digest @ vendor.3f801dae.js:6
$apply @ vendor.3f801dae.js:6
i @ vendor.3f801dae.js:6
u @ vendor.3f801dae.js:6
x.onload @ vendor.3f801dae.js:6

[axpatito]

Can't reproduce. Can you confirm the structure of your zip file, please?

[Spiderstryder]

The sample used is present here;
https://app.any.run/tasks/4163d33a-aabd-4ecf-9138-955b7c569ca5

here is an image of the issue

It also seems that Hive has an issue passing these files to Cortex, however if they are uploaded to Cortex directly there is no issue with handling them. Furthermore these issues don't occur with normal files, just password protected zips.

Further logs pertaining the display error:

  "java.lang.RuntimeException: 
	at scala.sys.package$.error(package.scala:27)
	at services.ArtifactSrv.similarArtifactFilter(ArtifactSrv.scala:141)
	at services.ArtifactSrv.findSimilar(ArtifactSrv.scala:129)
	at services.CaseSrv.$anonfun$linkedCases$1(CaseSrv.scala:154)
	at akka.stream.impl.fusing.Map$$anon$9.onPush(Ops.scala:53)
	at akka.stream.impl.fusing.GraphInterpreter.processPush(GraphInterpreter.scala:519)
	at akka.stream.impl.fusing.GraphInterpreter.execute(GraphInterpreter.scala:411)
	at akka.stream.impl.fusing.GraphInterpreterShell.runBatch(ActorGraphInterpreter.scala:585)
	at akka.stream.impl.fusing.GraphInterpreterShell$AsyncInput.execute(ActorGraphInterpreter.scala:469)
	at akka.stream.impl.fusing.GraphInterpreterShell.processEvent(ActorGraphInterpreter.scala:560)
"  

[nadouani]

Hello @Spiderstryder we will take a look on it, thanks

[To-om]

The problem occurs when the content type of the file can't be determined. In the error message the contentType is null whereas the value is mandatory.