search

CrowdStrike / crimson-falcon

A Shiny Ruby SDK of our Falcon API
https://rubygems.org/gems/crimson-falcon
MIT License
4 stars 1 forks source link

Falcon::ReportExecutionsApi#report_executions_download_get raise NoMethodError exception #35

Open hiboma opened 6 days ago

hiboma commented 6 days ago

Hello.

True to the title of the issue, I encountered Falcon::ReportExecutionsApi#report_executions_download_get raising an NoMethodError exception.

How to reproduce

Version (crimson-falcon)

0.4.1

Script

#!/usr/bin/env ruby

require 'dotenv'
require 'crimson-falcon'

Dotenv.load!

Falcon.configure do |config|
  config.client_id     = ENV["FALCON_CLIENT_ID"]
  config.client_secret = ENV["FALCON_CLIENT_SECRET"]
end

id = "1c22d83d74ae4ee9bac3208b8015eb58"

client = Falcon::ReportExecutionsApi.new
results = client.report_executions_download_get([id])
pp results

Exception

/private/tmp/falcon/vendor/bundle/ruby/3.3.0/gems/crimson-falcon-0.4.1/lib/crimson-falcon/api_client.rb:414:in `convert_to_type': undefined method `to_i' for an instance of Hash (NoMethodError)

        data.to_i
            ^^^^^
Did you mean?  to_s
               to_a
               to_h
    from /private/tmp/falcon/vendor/bundle/ruby/3.3.0/gems/crimson-falcon-0.4.1/lib/crimson-falcon/api_client.rb:431:in `block in convert_to_type'
    from /private/tmp/falcon/vendor/bundle/ruby/3.3.0/gems/crimson-falcon-0.4.1/lib/crimson-falcon/api_client.rb:431:in `map'
    from /private/tmp/falcon/vendor/bundle/ruby/3.3.0/gems/crimson-falcon-0.4.1/lib/crimson-falcon/api_client.rb:431:in `convert_to_type'
    from /private/tmp/falcon/vendor/bundle/ruby/3.3.0/gems/crimson-falcon-0.4.1/lib/crimson-falcon/api_client.rb:401:in `deserialize'
    from /private/tmp/falcon/vendor/bundle/ruby/3.3.0/gems/crimson-falcon-0.4.1/lib/crimson-falcon/api_client.rb:91:in `call_api'
    from /private/tmp/falcon/vendor/bundle/ruby/3.3.0/gems/crimson-falcon-0.4.1/lib/crimson-falcon/api/report_executions_api.rb:94:in `report_executions_download_get_with_http_info'
    from /private/tmp/falcon/vendor/bundle/ruby/3.3.0/gems/crimson-falcon-0.4.1/lib/crimson-falcon/api/report_executions_api.rb:44:in `report_executions_download_get'
    from bug.rb:17:in `<main>'

Debug Response

( Sensitive information is masked *** ) 

D, [2024-06-24T15:39:12.799687 #56275] DEBUG -- : Calling API: ReportExecutionsApi.report_executions_download_get ...
{:method=>:get, :headers=>{"Content-Type"=>"application/json", "User-Agent"=>"crowdstrike-crimson/0.4.1", "Accept"=>"*/*", "Authorization"=>"Bearer ***"}, :params=>{:ids=>["1c22d83d74ae4ee9bac3208b8015eb58"]}, :params_encoding=>:multi, :timeout=>0, :ssl_verifypeer=>true, :ssl_verifyhost=>2, :sslcert=>nil, :sslkey=>nil, :verbose=>true, :followlocation=>false}
https://api.crowdstrike.com/reports/entities/report-executions-download/v1
Found bundle for host: 0x600000d9ab80 [serially]
Can not multiplex, even if we wanted to
Re-using existing connection with host api.crowdstrike.com
GET /reports/entities/report-executions-download/v1?ids=1c22d83d74ae4ee9bac3208b8015eb58 HTTP/1.1
Host: api.crowdstrike.com
User-Agent: crowdstrike-crimson/0.4.1
Content-Type: application/json
Accept: */*
Authorization: Bearer ***

HTTP/1.1 200 OK
Server: nginx
Date: Mon, 24 Jun 2024 06:39:13 GMT
Content-Type: application/json
Content-Length: 295
Connection: keep-alive
Accept-Ranges: bytes
Content-Disposition: attachment;filename=IP_2024_June_24_61519_74136.json
Etag: "62efa676e8d523e837e6770b8f5cfe04"
Last-Modified: Mon, 24 Jun 2024 06:15:38 GMT
Strict-Transport-Security: max-age=15724800; includeSubDomains
X-Amz-Expiration: expiry-date="Thu, 25 Jul 2024 00:00:00 GMT", rule-id="ZmI0YzJhNmQtYzJkMS00OTU4LWJmY2QtOWYxNTkxMzRlNjJl"
X-Amz-Id-2: ***
X-Amz-Request-Id: ***
X-Amz-Server-Side-Encryption: AES256
X-Cs-Region: ***
X-Cs-Traceid: ***
X-Ratelimit-Limit: 6000
X-Ratelimit-Remaining: 5999
Strict-Transport-Security: max-age=31536000; includeSubDomains

Connection #0 to host api.crowdstrike.com left intact
D, [2024-06-24T15:39:13.084426 #56275] DEBUG -- : HTTP response body ~BEGIN~
[{"ComputerName":"***","ConnectionDirection":"1","ContextBaseFileName":"ControlCenter","Event_Name":"NetworkReceiveAcceptIP4","Global_IP":"***","LPort":"7000","Local_IP4":"***","Platform":"Mac","RPort":"53982","Remote_IP4":"***","timestamp":"1719209547865"}]
hiboma commented 6 days ago

I have tried and found that specifying debug_return_type: Object avoids the exception.

client.report_executions_download_get([id], opts = { debug_return_type: "Object"} )