MISP event filter require manual escapes

[derDuffy]

Request Type

Bug

Problem Description

The filter for MISP events produces errors if certain characters are not manually escaped before filtering.
This is for example the case if one would like to filter for a tlp tag like tlp:green it will only work if one searches for tlp\:green otherwise shared errors will appear.

Steps to Reproduce

1. Navigate to the MISP events page
2. Filter for colon

[nadouani]

Hi @derDuffy, the issue here is that the colon is a "reserved" character, I mean that we cannot escape it since it should not for queries like field:value(example: eventStatus:New).

This requires us to implement a query syntax parser and validator, which is not something with "low priority" if we provide a more elaborated filter form, as described in #86

To escape the field values that contains reserved chars, make sure to wrap the value with quotes: tags:"tlp:white"

[nadouani]

Closing as duplicate of #86 where we will add a new filtering form