diff --git a/opencti-platform/opencti-graphql/src/modules/indicator/indicator-domain.ts b/opencti-platform/opencti-graphql/src/modules/indicator/indicator-domain.ts index 97c9cc4dfb27..6d85127b6fb9 100644 --- a/opencti-platform/opencti-graphql/src/modules/indicator/indicator-domain.ts +++ b/opencti-platform/opencti-graphql/src/modules/indicator/indicator-domain.ts @@ -336,6 +336,16 @@ export const indicatorEditField = async (context: AuthContext, user: AuthUser, i finalInput.push({ key: 'valid_until', value: [newValidUntilDate.toISOString()] }); } } + // check indicator pattern syntax + const patternEditInput = input.find((e) => e.key === 'pattern'); + if (patternEditInput) { + const patternType = indicator.pattern_type.toLowerCase(); + const formattedPattern = cleanupIndicatorPattern(patternType, patternEditInput.value[0]); + const check = await checkIndicatorSyntax(context, user, patternType, formattedPattern); + if (check === false) { + throw FunctionalError(`Indicator of type ${indicator.pattern_type} is not correctly formatted.`); + } + } logApp.info('indicatorEditField finalInput', { finalInput }); return stixDomainObjectEditField(context, user, id, finalInput, opts); }; diff --git a/opencti-platform/opencti-graphql/tests/02-integration/02-resolvers/indicator-test.ts b/opencti-platform/opencti-graphql/tests/02-integration/02-resolvers/indicator-test.ts index bdfe27de4535..605bde18c9c9 100644 --- a/opencti-platform/opencti-graphql/tests/02-integration/02-resolvers/indicator-test.ts +++ b/opencti-platform/opencti-graphql/tests/02-integration/02-resolvers/indicator-test.ts @@ -1,6 +1,6 @@ import { expect, it, describe } from 'vitest'; import gql from 'graphql-tag'; -import { queryAsAdmin } from '../../utils/testQuery'; +import { adminQuery, queryAsAdmin } from '../../utils/testQuery'; import { ENTITY_DOMAIN_NAME } from '../../../src/schema/stixCyberObservable'; import { MARKING_TLP_GREEN } from '../../../src/schema/identifier'; import type { BasicStoreEntityEdge } from '../../../src/types/store'; @@ -94,6 +94,15 @@ const CREATE_QUERY = gql` } `; +const UPDATE_QUERY = gql` + mutation IndicatorFieldPatch($id: ID!, $input: [EditInput!]!) { + indicatorFieldPatch(id: $id, input: $input) { + id + name + } + } +`; + describe('Indicator resolver standard behavior', () => { let firstIndicatorInternalId: string; let secondIndicatorInternalId: string; @@ -203,15 +212,15 @@ describe('Indicator resolver standard behavior', () => { expect(indicatorCreatedEarlier).toBeDefined(); } }); + it('should not update indicator with incorrectly formatted pattern', async () => { + const queryResult = await adminQuery({ + query: UPDATE_QUERY, + variables: { id: firstIndicatorInternalId, input: { key: 'pattern', value: ["[domain-name:value &&& 'www.wrong.pattern']"] } }, + }); + expect(queryResult.errors).toBeDefined(); + expect(queryResult.errors[0].message).toBe('Indicator of type stix is not correctly formatted.'); + }); it('should update indicator', async () => { - const UPDATE_QUERY = gql` - mutation IndicatorFieldPatch($id: ID!, $input: [EditInput!]!) { - indicatorFieldPatch(id: $id, input: $input) { - id - name - } - } - `; const queryResult = await queryAsAdminWithSuccess({ query: UPDATE_QUERY, variables: { id: firstIndicatorInternalId, input: { key: 'name', value: ['Indicator - test'] } },