ibmresilient / resilient-community-apps

Source code for IBM SOAR Apps that are available on our App Exchange
https://ibm.biz/soar-apps-docs
MIT License
88 stars 96 forks source link

fn_virustotal proxy issue #47

Open LiamMahoney opened 4 years ago

LiamMahoney commented 4 years ago

Description

The documentation didn't have any information pertaining how to configure the proxies setting in the config file. I was having problems getting the function to work with my proxy information.

Initially I passed a string containing my proxy information into the config proxies variable, e.g. proxies = http://myproxy:8080. After doing so I got the following error in Resilient:

FunctionException_: <Traceback (most recent call last): 
File "/home/integration/.local/lib/python2.7/site-packages/fn_virustotal/components/virustotal.py", line 123, in _virustotal_function response = vt.get_file_report(vt_data) 
File "/home/integration/.local/lib/python2.7/site-packages/virus_total_apis/api.py", line 134, in get_file_report response = requests.get(self.base + 'file/report', params=params, proxies=self.proxies, timeout=timeout) File "/usr/local/lib/python2.7/site-packages/requests/api.py", line 72, in get return request('get', url, params=params, **kwargs) 
File "/usr/local/lib/python2.7/site-packages/requests/api.py", line 58, in request return session.request(method=method, url=url, **kwargs) 
File "/usr/local/lib/python2.7/site-packages/requests/sessions.py", line 499, in request prep.url, proxies, stream, verify, cert File "/usr/local/lib/python2.7/site-packages/requests/sessions.py", line 671, in merge_environment_settings no_proxy = proxies.get('no_proxy') if proxies is not None else None AttributeError: 'unicode' object has no attribute 'get' > 
File "/usr/local/lib/python2.7/site-packages/circuits/core/manager.py", line 856, in processTask raise value.extract()

I noticed the line AttributeError: 'unicode' object has no attribute 'get' which led me to believe that a dict object was needed. I created a dict similar to what the requests library proxies value expects (https://stackoverflow.com/questions/17781767/understanding-the-proxies-parameter-in-requests-module) e.g. proxies = {"http": "http://myproxy:8080", "https": "http://myproxy:8080", "no_proxy": ".*mydomain"}. I passed that into the config proxies variable, but still got the same error above.

Then I added some code to parse the string coming into the function via the config object as a json dict, and now the requests are working properly. See "To Fix" below.

Describe How to Reproduce

Attempt to call the function with proxy information configured. See examples above on how I was setting proxy information in the config.

To Fix

I imported json at the top of the file. Then on line 57 I replaced vt = VirusTotal(self.options['api_token'], self.options['proxies']) with vt = VirusTotal(self.options['api_token'], json.loads(self.options['proxies'])).

After making the above two changes the function works as desired.

Not sure if a pull request is needed or what the next steps should be, figured it should be documented though.

Additionally, it might be helpful to update the the documentation to describe that a dictionary is needed for requests through a proxy. e.g. proxies = {"http": "http://myproxy:8080", "https": "http://myproxy:8080", "no_proxy": ".*mydomain"}