Malware knowledge panel markings issue

[JeremyCloarec]

Description

"Entities view" in knowledge panel doesn't filter out entities with the markings of their relationship. When switching to "Relationships view", markings are properly applied. I found this bug on the malware panel bug the bug should be the same for other entities.

Environment

1. OS (where OpenCTI server runs): { e.g. Mac OS 10, Windows 10, Ubuntu 16.4, etc. }
2. OpenCTI version: { e.g. OpenCTI 1.0.2 }
3. OpenCTI client: { e.g. frontend or python }
4. Other environment details:

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Log in with a user A with access to TLP:RED marking
2. Create a malware
3. Go to it's knowledge tab
4. Go to Victimology
5. Create two relationships, one with TLP:GREEN marking and one with TLP:RED marking
6. Log in with a user B with access to TLP:GREEN marking
7. Go to the same malware's Victimology tab

Expected Output

User B can see both relationship targets in Entities view

Actual Output

User B can only see the TLP:GREEN relationship target in Entities view

Additional information

Bug doesn't occur only on Victimology tab but on other tabs also (tested and reproduced on Threat actors tab, I assume that the bug is there on all tabs)

Relationships view with TLP:GREEN user: Relationships view with TLP:RED user: Entities view with both users:

[jborozco]

can be reproduced here https://testing.octi.staging.filigran.io/dashboard/arsenal/malwares/ac682b2a-bbc8-4462-8ea2-e959567d693c/knowledge/victimology

[JeremyCloarec]

More info on the bug: the bug occurs on all queries using the "regardingOf" filter. The "regardingOf" filter uses the denormalized refs of entities to filter for relations (it checks if rel_relationType exists/targets ids given in regardingOf). But by doing so, it doesn't check for access restrictions on the filtered relations. To fix the "regardingOf" filter, we need a way to also check for access restrictions to the relations

[richard-julien]

Known technical limitation. We need to talk about this

[aHenryJard]

Reopening since the PR has been revert.

[Jipegien]

is @JeremyCloarec still on this?

[JeremyCloarec]

Yes, I will work on a new fix

[JeremyCloarec]

Placing this bug on pause. Fixing it requires current rework of denormalized relations to be finished.