CybercentreCanada / assemblyline

AssemblyLine 4: File triage and malware analysis
https://cybercentrecanada.github.io/assemblyline4_docs/
MIT License
249 stars 15 forks source link

Server returns HTTP 500 when adding new badlist tag #280

Open jasper-vdhoven opened 1 month ago

jasper-vdhoven commented 1 month ago

Describe the bug When creating a new badlist tag through the Assemblyline UI, the server returns an HTTP 500 error.

To Reproduce Steps to reproduce the behavior:

  1. Go to Manage -> Badlist
  2. Click on Add an item to the badlist
  3. Select network.dynamic.domain as the tag type, foo.bar as the tag value and lorem ipsum as the Item Details
  4. Save the tag and the server responds with an HTTP 500 error

Expected behavior In previous versions of AL this would successfully add a tag to the badlist. This feature still works when creating a new tag from an existing submission, it only appears when creating a new badlist item from scratch.

Screenshots image

image

Environment (please complete the following information if pertinent):

cccs-rs commented 1 month ago

Looks like a bug on the frontend side where the classification isn't being passed forward to the API (and the classification is required for adding an item), you can check the Payload tab to confirm but that's what I'm currently seeing on our test system.

jasper-vdhoven commented 4 weeks ago

Yeah, that is what I'm seeing as well, the classification element is an empty string (i.e. ""), similar to the id value. Is this id value also not meant to be empty?

al-bug

cccs-rs commented 4 weeks ago

I believe for adding things to the list, having the id unset is fine because the system has to generate an identifier based on the information of the item.

kam193 commented 4 weeks ago

Could it be that it had a similar root cause as #273 ?

cccs-rs commented 4 weeks ago

Possibly but not entirely sure.