[backend] check indicator pattern syntax when update (OpenCTI-Platfor…

…m#8683)
fbicyber · Oct 22, 2024 · 7d60d33 · 7d60d33
1 parent e44e755
commit 7d60d33
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 9 deletions.
diff --git a/opencti-platform/opencti-graphql/src/modules/indicator/indicator-domain.ts b/opencti-platform/opencti-graphql/src/modules/indicator/indicator-domain.ts
@@ -336,6 +336,16 @@ export const indicatorEditField = async (context: AuthContext, user: AuthUser, i
       finalInput.push({ key: 'valid_until', value: [newValidUntilDate.toISOString()] });
     }
   }
+  // check indicator pattern syntax
+  const patternEditInput = input.find((e) => e.key === 'pattern');
+  if (patternEditInput) {
+    const patternType = indicator.pattern_type.toLowerCase();
+    const formattedPattern = cleanupIndicatorPattern(patternType, patternEditInput.value[0]);
+    const check = await checkIndicatorSyntax(context, user, patternType, formattedPattern);
+    if (check === false) {
+      throw FunctionalError(`Indicator of type ${indicator.pattern_type} is not correctly formatted.`);
+    }
+  }
   logApp.info('indicatorEditField finalInput', { finalInput });
   return stixDomainObjectEditField(context, user, id, finalInput, opts);
 };

diff --git a/opencti-platform/opencti-graphql/tests/02-integration/02-resolvers/indicator-test.ts b/opencti-platform/opencti-graphql/tests/02-integration/02-resolvers/indicator-test.ts
@@ -1,6 +1,6 @@
 import { expect, it, describe } from 'vitest';
 import gql from 'graphql-tag';
-import { queryAsAdmin } from '../../utils/testQuery';
+import { adminQuery, queryAsAdmin } from '../../utils/testQuery';
 import { ENTITY_DOMAIN_NAME } from '../../../src/schema/stixCyberObservable';
 import { MARKING_TLP_GREEN } from '../../../src/schema/identifier';
 import type { BasicStoreEntityEdge } from '../../../src/types/store';
@@ -94,6 +94,15 @@ const CREATE_QUERY = gql`
     }
 `;
 
+const UPDATE_QUERY = gql`
+  mutation IndicatorFieldPatch($id: ID!, $input: [EditInput!]!) {
+    indicatorFieldPatch(id: $id, input: $input) {
+      id
+      name
+    }
+  }
+`;
+
 describe('Indicator resolver standard behavior', () => {
   let firstIndicatorInternalId: string;
   let secondIndicatorInternalId: string;
@@ -203,15 +212,15 @@ describe('Indicator resolver standard behavior', () => {
       expect(indicatorCreatedEarlier).toBeDefined();
     }
   });
+  it('should not update indicator with incorrectly formatted pattern', async () => {
+    const queryResult = await adminQuery({
+      query: UPDATE_QUERY,
+      variables: { id: firstIndicatorInternalId, input: { key: 'pattern', value: ["[domain-name:value &&& 'www.wrong.pattern']"] } },
+    });
+    expect(queryResult.errors).toBeDefined();
+    expect(queryResult.errors[0].message).toBe('Indicator of type stix is not correctly formatted.');
+  });
   it('should update indicator', async () => {
-    const UPDATE_QUERY = gql`
-        mutation IndicatorFieldPatch($id: ID!, $input: [EditInput!]!) {
-            indicatorFieldPatch(id: $id, input: $input) {
-                id
-                name
-            }
-        }
-    `;
     const queryResult = await queryAsAdminWithSuccess({
       query: UPDATE_QUERY,
       variables: { id: firstIndicatorInternalId, input: { key: 'name', value: ['Indicator - test'] } },