howler-api 3.2.0.dev475__tar.gz → 3.2.0.dev490__tar.gz

{howler_api-3.2.0.dev475 → howler_api-3.2.0.dev490}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 3.2.0.dev475
+Version: 3.2.0.dev490
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-3.2.0.dev475 → howler_api-3.2.0.dev490}/howler/api/v1/search.py

@@ -10,7 +10,7 @@ from sigma.rule import SigmaRule
 from werkzeug.exceptions import BadRequest
 from yaml.scanner import ScannerError
 
-from howler.api import bad_request, make_subapi_blueprint, ok
+from howler.api import bad_request, forbidden, make_subapi_blueprint, ok
 from howler.common.loader import datastore
 from howler.common.logging import get_logger
 from howler.common.swagger import generate_swagger_docs
@@ -25,6 +25,8 @@ search_api._doc = "Perform search queries"  # type: ignore
 
 logger = get_logger(__file__)
 
+SENSITIVE_USER_FIELDS = ["password", "apikeys", "*"]
+
 
 def generate_params(request: Request, fields: list[str], multi_fields: list[str], params: dict[str, Any] | None = None):
     """Generate a list of parameters, combining the request data and the query arguments"""
@@ -136,6 +138,13 @@ def search(index, **kwargs):
     if not query:
         return bad_request(err="There was no search query.")
 
+    if (
+        "fl" in params
+        and index == "user"
+        and any(sensitive_field in params["fl"] for sensitive_field in SENSITIVE_USER_FIELDS)
+    ):
+        return forbidden(err="Invalid fields to retrieve.")
+
     try:
         metadata = params.pop("metadata", [])
         result = collection().search(query, as_obj=False, **params)
@@ -276,6 +285,13 @@ def eql_search(index, **kwargs):
     if not eql_query:
         return bad_request(err="There was no EQL search query.")
 
+    if (
+        "fl" in params
+        and index == "user"
+        and any(sensitive_field in params["fl"] for sensitive_field in SENSITIVE_USER_FIELDS)
+    ):
+        return forbidden(err="Invalid fields to retrieve.")
+
     try:
         return ok(collection().raw_eql_search(**params))
     except (SearchException, BadRequestError) as e:
@@ -364,6 +380,13 @@ def sigma_search(index, **kwargs):
 
     lucene_queries = LuceneBackend(index_names=[es_collection.index_name]).convert_rule(rule)
 
+    if (
+        "fl" in params
+        and index == "user"
+        and any(sensitive_field in params["fl"] for sensitive_field in SENSITIVE_USER_FIELDS)
+    ):
+        return forbidden(err="Invalid fields to retrieve.")
+
     try:
         return ok(es_collection.search("*:*", **params, filters=[*params.get("filters", []), *lucene_queries]))
     except (SearchException, BadRequestError) as e:
@@ -432,6 +455,13 @@ def group_search(index, group_field, **kwargs):
     if not group_field:
         return bad_request(err="The field to group on was not specified.")
 
+    if (
+        "fl" in params
+        and index == "user"
+        and any(sensitive_field in params["fl"] for sensitive_field in SENSITIVE_USER_FIELDS)
+    ):
+        return forbidden(err="Invalid fields to retrieve.")
+
     try:
         return ok(collection().grouped_search(group_field, **params))
     except (SearchException, BadRequestError) as e:
@@ -592,6 +622,9 @@ def facet(index, **kwargs):
                 logger.warning("Invalid field %s requested for faceting, skipping", field)
                 continue
 
+            if index == "user" and any(sensitive_field in field for sensitive_field in SENSITIVE_USER_FIELDS):
+                return forbidden(err="Invalid fields to facet on.")
+
             facet_result[field] = collection().facet(field, **params)
 
         return ok(facet_result)
@@ -642,6 +675,9 @@ def facet_field(index, field, **kwargs):
     if field_info is None:
         return bad_request(err=f"Field '{field}' is not a valid field in index: {index}")
 
+    if index == "user" and any(sensitive_field in field for sensitive_field in SENSITIVE_USER_FIELDS):
+        return forbidden(err="Invalid field to facet on.")
+
     fields = ["query", "mincount", "rows"]
     multi_fields = ["filters"]
 

{howler_api-3.2.0.dev475 → howler_api-3.2.0.dev490}/pyproject.toml

@@ -152,7 +152,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "3.2.0.dev475"
+version = "3.2.0.dev490"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",