search

certtools / intelmq

IntelMQ is a solution for IT security teams for collecting and processing security feeds using a message queuing protocol.
https://docs.intelmq.org/latest/
GNU Affero General Public License v3.0
976 stars 297 forks source link

Can we change it to check for empty "" instead of None. Shadowserver api collector. #2477

Closed sarabesh closed 8 months ago

sarabesh commented 8 months ago

https://github.com/certtools/intelmq/blob/42a9bfa2a49801659ec8f0f462ee76d4734a7e33/intelmq/bots/collectors/shadowserver/collector_reports_api.py#L112

By default from the intelmq, types is added as "", when we leave it empty though all the JSON conversions. So, I had some time to figure out why my reports were being filtered. Eventually, as a temporary work around I removed the types parameter completely.

kamil-certat commented 8 months ago

Looks like it should be just if not self.types

sebix commented 8 months ago

Yes, that's clearly a bug

elsif2 commented 8 months ago

I believe it should be if self.types.

elsif2 commented 8 months ago

All the other parameters are tested with is None so I don't see why types is handled differently.

sebix commented 8 months ago

Depends on what you check for. If "", False and None should be treated equally, use if self.types, otherwise check for the value explicitly. "" usually appears when a bot is edited with the manager and should always be handled.