dfir-iris / iris-web

Collaborative Incident Response platform
GNU Lesser General Public License v3.0
1.07k stars 181 forks source link

When downloading csv list of IOCs some entries are cut off if they are too long [BUG] #126

Closed helalucas closed 1 year ago

helalucas commented 2 years ago

Describe the bug When downloading the ioc list in csv form if an entry is too long, the full entry will not be visible in the csv - instead something like:

filename.exe | ba7816bf8f01cfea414140de5dae2223b00361 (...)

will be visible

To Reproduce Steps to reproduce the behavior:

  1. in the indicator of compromise tab in a case - create an ioc entry of type: filename:sha256 and put in an example filename and hash
  2. Download csv file of IOC list
  3. examine csv file

Expected behavior The csv file should contain the full sha256 rather than "ba7816bf8f01cfea414140de5dae2223b00361a39(...)"

Screenshots n/a

Desktop (please complete the following information):

whikernel commented 2 years ago

Hi @helalucas Thanks for the report 👍. This is an issue that impacts almost all tables in the case pages. We've implemented a cut of the text when getting longer than a fixed size. That was to avoid having tables with really long/broken columns on small screens. For the downloads we use the builtin feature of Datatables, which seems to take the displayed data and thus produce these incomplete CSVs. We'll look into this 👍

Cheers