howler-api 4.1.0.dev1452__tar.gz → 4.1.0.dev1460__tar.gz

{howler_api-4.1.0.dev1452 → howler_api-4.1.0.dev1460}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: howler-api
-Version: 4.1.0.dev1452
+Version: 4.1.0.dev1460
 Summary: Howler - API server
 License: MIT
 Keywords: howler,alerting,gc,canada,cse-cst,cse,cst,cyber,cccs

{howler_api-4.1.0.dev1452 → howler_api-4.1.0.dev1460}/howler/api/v2/search.py

@@ -7,7 +7,7 @@ from elasticsearch import BadRequestError
 from elasticsearch._sync.client.indices import IndicesClient
 from flask import request
 
-from howler.api import bad_request, internal_error, make_subapi_blueprint, ok
+from howler.api import bad_request, forbidden, internal_error, make_subapi_blueprint, ok
 from howler.common.loader import datastore
 from howler.common.logging import get_logger
 from howler.common.logging.audit import audit
@@ -17,6 +17,7 @@ from howler.helper.search import get_collection, has_access_control
 from howler.odm.models.user import User
 from howler.security import api_login
 from howler.services import hit_service, lucene_service, search_service
+from howler.services.search_service import SensitiveUserFieldsException
 from howler.utils.net_utils import generate_params
 
 SUB_API = "search"
@@ -98,7 +99,10 @@ def search(indexes: str, user: User, **kwargs):
         }
     )
 
-    params["sort"] = [entry for entry in params.get("sort", "").split(",") if entry] or search_service.DEFAULT_SORT
+    if params.get("sort"):
+        params["sort"] = [entry for entry in params["sort"].split(",") if entry]
+    else:
+        params.pop("sort", None)
 
     query = req_data.get("query", None)
     if not query:
@@ -110,6 +114,8 @@ def search(indexes: str, user: User, **kwargs):
 
     try:
         result = search_service.search(indexes, query, user=user, **params)
+    except SensitiveUserFieldsException as e:
+        return forbidden(err=e.message)
     except (SearchException, BadRequestError) as e:
         logger.exception(f"SearchException on query {query}")
         return bad_request(err=f"SearchException on query {query}: {str(e)}")

{howler_api-4.1.0.dev1452 → howler_api-4.1.0.dev1460}/howler/services/search_service.py

@@ -10,7 +10,7 @@ from howler.common.logging import get_logger
 from howler.datastore.collection import parse_sort
 from howler.datastore.exceptions import SearchException, SearchRetryException
 from howler.datastore.types import SearchResult
-from howler.helper.search import get_collection, has_access_control
+from howler.helper.search import get_collection, get_default_sort, has_access_control
 from howler.odm.models.user import User
 from howler.services import case_service
 from howler.utils.indexes import get_logical_index_name, normalize_indexes
@@ -20,10 +20,15 @@ DEFAULT_ROW_SIZE = 25
 DEFAULT_SORT: list[dict[str, str]] = [{"_id": "asc"}]
 DEFAULT_SEARCH_FIELD = "__text__"
 SCROLL_TIMEOUT = "5m"
+SENSITIVE_USER_FIELDS = ["password", "apikeys", "*"]
 
 logger = get_logger(__file__)
 
 
+class SensitiveUserFieldsException(SearchException):
+    """Raised when a user search requests protected source fields."""
+
+
 def _format_items(hits: list[dict[str, Any]], user_classification: str | None) -> list[dict[str, Any]]:
     """Formats Elasticsearch search hits into a standardized item format.
 
@@ -93,6 +98,14 @@ def search(  # noqa: C901
     """
     del metadata
 
+    index_list = _parse_index_list(indexes)
+    if (
+        fl is not None
+        and "user" in index_list
+        and any(sensitive_field in fl for sensitive_field in SENSITIVE_USER_FIELDS)
+    ):
+        raise SensitiveUserFieldsException("Invalid fields to retrieve.")
+
     client: Elasticsearch = datastore().ds.client
     parsed_indexes = normalize_indexes(indexes)
 
@@ -113,7 +126,12 @@ def search(  # noqa: C901
         query = "id:*"
 
     if sort is None:
-        sort = DEFAULT_SORT
+        default_sorts = [get_default_sort(index, user) for index in _parse_index_list(indexes)] if user else []
+        default_sort = default_sorts[0] if default_sorts else None
+        if default_sort is not None and all(index_sort == default_sort for index_sort in default_sorts):
+            sort = default_sort
+        else:
+            sort = DEFAULT_SORT
 
     if rows is None:
         rows = DEFAULT_ROW_SIZE

{howler_api-4.1.0.dev1452 → howler_api-4.1.0.dev1460}/pyproject.toml

@@ -152,7 +152,7 @@ suppress-none-returning = true
 [tool.poetry]
 package-mode = true
 name = "howler-api"
-version = "4.1.0.dev1452"
+version = "4.1.0.dev1460"
 description = "Howler - API server"
 authors = [
     "Canadian Centre for Cyber Security <howler@cyber.gc.ca>",