howler-api 3.1.0.dev426__tar.gz → 3.1.1.485__tar.gz

{howler_api-3.1.0.dev426 → howler_api-3.1.1.485}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 3.1.0.dev426
+Version: 3.1.1.485
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-3.1.0.dev426 → howler_api-3.1.1.485}/howler/api/v1/search.py

@@ -10,7 +10,7 @@ from sigma.rule import SigmaRule
 from werkzeug.exceptions import BadRequest
 from yaml.scanner import ScannerError
 
-from howler.api import bad_request, make_subapi_blueprint, ok
+from howler.api import bad_request, forbidden, make_subapi_blueprint, ok
 from howler.common.loader import datastore
 from howler.common.logging import get_logger
 from howler.common.swagger import generate_swagger_docs
@@ -25,6 +25,8 @@ search_api._doc = "Perform search queries"
 
 logger = get_logger(__file__)
 
+SENSITIVE_USER_FIELDS = ["password", "apikeys", "*"]
+
 
 def generate_params(request, fields, multi_fields, params=None):
     """Generate a list of parameters, combining the request data and the query arguments"""
@@ -137,6 +139,13 @@ def search(index, **kwargs):
     if not query:
         return bad_request(err="There was no search query.")
 
+    if (
+        "fl" in params
+        and index == "user"
+        and any(sensitive_field in params["fl"] for sensitive_field in SENSITIVE_USER_FIELDS)
+    ):
+        return forbidden(err="Invalid fields to retrieve.")
+
     try:
         metadata = params.pop("metadata", [])
         result = collection().search(query, **params)
@@ -277,6 +286,13 @@ def eql_search(index, **kwargs):
     if not eql_query:
         return bad_request(err="There was no EQL search query.")
 
+    if (
+        "fl" in params
+        and index == "user"
+        and any(sensitive_field in params["fl"] for sensitive_field in SENSITIVE_USER_FIELDS)
+    ):
+        return forbidden(err="Invalid fields to retrieve.")
+
     try:
         return ok(collection().raw_eql_search(**params))
     except (SearchException, BadRequestError) as e:
@@ -365,6 +381,13 @@ def sigma_search(index, **kwargs):
 
     lucene_queries = LuceneBackend(index_names=[es_collection.index_name]).convert_rule(rule)
 
+    if (
+        "fl" in params
+        and index == "user"
+        and any(sensitive_field in params["fl"] for sensitive_field in SENSITIVE_USER_FIELDS)
+    ):
+        return forbidden(err="Invalid fields to retrieve.")
+
     try:
         return ok(es_collection.search("*:*", **params, filters=[*params.get("filters", []), *lucene_queries]))
     except (SearchException, BadRequestError) as e:
@@ -433,6 +456,13 @@ def group_search(index, group_field, **kwargs):
     if not group_field:
         return bad_request(err="The field to group on was not specified.")
 
+    if (
+        "fl" in params
+        and index == "user"
+        and any(sensitive_field in params["fl"] for sensitive_field in SENSITIVE_USER_FIELDS)
+    ):
+        return forbidden(err="Invalid fields to retrieve.")
+
     try:
         return ok(collection().grouped_search(group_field, **params))
     except (SearchException, BadRequestError) as e:
@@ -593,6 +623,9 @@ def facet(index, **kwargs):
                 logger.warning("Invalid field %s requested for faceting, skipping", field)
                 continue
 
+            if index == "user" and any(sensitive_field in field for sensitive_field in SENSITIVE_USER_FIELDS):
+                return forbidden(err="Invalid fields to facet on.")
+
             facet_result[field] = collection().facet(field, **params)
 
         return ok(facet_result)
@@ -643,6 +676,9 @@ def facet_field(index, field, **kwargs):
     if field_info is None:
         return bad_request(err=f"Field '{field}' is not a valid field in index: {index}")
 
+    if index == "user" and any(sensitive_field in field for sensitive_field in SENSITIVE_USER_FIELDS):
+        return forbidden(err="Invalid field to facet on.")
+
     fields = ["query", "mincount", "rows"]
     multi_fields = ["filters"]
 

{howler_api-3.1.0.dev426 → howler_api-3.1.1.485}/howler/datastore/collection.py

@@ -422,7 +422,6 @@ class ESCollection(Generic[ModelType]):
         res = None
         while res is None:
             attempt = attempt + 1
-            logger.warning("Checking status of task %s (Attempt %s)", task["task"], attempt)
             try:
                 res = self.with_retries(
                     self.datastore.client.tasks.get,
@@ -443,8 +442,6 @@ class ESCollection(Generic[ModelType]):
 
         result = res.get("response", res["task"]["status"])
 
-        logger.info("Task result:\n%s", str(result))
-
         return result
 
     def _get_current_alias(self, index: str) -> typing.Optional[str]:

{howler_api-3.1.0.dev426 → howler_api-3.1.1.485}/howler/services/lucene_service.py

@@ -28,7 +28,7 @@ TRANSPORT_TIMEOUT = int(os.environ.get("HWL_DATASTORE_TRANSPORT_TIMEOUT", "10"))
 class LuceneProcessor(TreeVisitor):
     "Tree visitor that evaluates a query on a given object"
 
-    def visit(self, tree: Any, context: dict[str, Any]) -> bool:
+    def visit(self, tree: Any, context: dict[str, Any]) -> bool:  # pyright: ignore[reportIncompatibleMethodOverride]
         "Visit each node in a tree"
         return super().visit(tree, context)[0]
 
@@ -252,6 +252,8 @@ def match(lucene: str, obj: dict[str, Any]):
         # which means the two are equivalent in elastic, but the second one is a lot less ambiguous to parse.
         normalized_query = cast(str, result["explanations"][0]["explanation"])
 
+        normalized_query = re.sub(r"IndexOrDocValuesQuery *\(indexQuery=(.+?), dvQuery=.+?\)", r"\1", normalized_query)
+
         # Elastic's explanation mangles exists queries. Since we will handle them the normal way, reset their changes
         normalized_query = re.sub(r"FieldExistsQuery *\[.*?field=(.+?)]", r"_exists_:\1", normalized_query)
         normalized_query = re.sub(r"ConstantScore", "", normalized_query)

{howler_api-3.1.0.dev426 → howler_api-3.1.1.485}/howler/utils/lucene.py

@@ -20,7 +20,7 @@ def try_parse_date(date: str) -> Optional[datetime]:
         return None
 
 
-def try_parse_number(number: Union[str, int, float]) -> Optional[Union[int, float]]:
+def try_parse_number(number: str | int | float) -> int | float | None:
     "Try and parse a number string into an integer or float type, or infinity. Returns None if string is invalid."
     if isinstance(number, (int, float)):
         return number

{howler_api-3.1.0.dev426 → howler_api-3.1.1.485}/pyproject.toml

@@ -148,7 +148,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "3.1.0.dev426"
+version = "3.1.1.485"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",