google / timesketch

Collaborative forensic timeline analysis
Apache License 2.0
2.52k stars 577 forks source link

Address inconsistent property usage in API client search class #3100

Closed jawilson0502 closed 3 weeks ago

jawilson0502 commented 1 month ago

Describe the bug The setter function needs to be utilized for max_entries or there will be strange behavior in the from_manual function - https://github.com/google/timesketch/blob/master/api_client/python/timesketch_api_client/search.py#L653

max_entries setter function - https://github.com/google/timesketch/blob/master/api_client/python/timesketch_api_client/search.py#L841 Example of the setter function not being used - https://github.com/google/timesketch/blob/master/api_client/python/timesketch_api_client/search.py#L699-L700 (In the "To Reproduce section, I demonstrate why it is important)

To be consistent, it would be best to always use the properties provided, such as: return_fields - https://github.com/google/timesketch/blob/master/api_client/python/timesketch_api_client/search.py#L956 query_string - https://github.com/google/timesketch/blob/master/api_client/python/timesketch_api_client/search.py#L927

Incoming PR to also standardize a bit more for self.property_name vs self._property_name

To Reproduce Example of how to trigger the behavior in ipython

In [9]: search_obj.from_manual(query_string="my search", max_entries=2, return_fields='timestamp_desc,data_type,message,domain,url')

In [13]: search_obj.max_entries
Out[13]: 2

In [14]: search_obj.query_filter
Out[14]:
{'size': 10000,
 'terminate_after': 10000,
 'indices': '_all',
 'order': 'asc',
 'chips': []}
# Now use the setter function for max entries
In [15]: search_obj.max_entries = 2
# Which will modify the query filter
In [16]: search_obj.query_filter
Out[16]:
{'size': 2,
 'terminate_after': 2,
 'indices': '_all',
 'order': 'asc',
 'chips': []}

Expected behavior I expected from_manual() to set the query_filter.

jkppr commented 3 weeks ago

This fix will be part of the next API client release published end of june 👍