search

ibmresilient / resilient-community-apps

Source code for IBM SOAR Apps that are available on our App Exchange
https://ibm.biz/soar-apps-docs
MIT License
88 stars 96 forks source link

Potential bug in utilities_base64_to_artifact.py #54

Closed backcountryinfosec closed 4 years ago

backcountryinfosec commented 4 years ago

Description

In this script it appears that you take a string which is already base64 encoded: base64content = str.encode(str(kwargs.get("base64content"))) # text

And then you are re base64 encoding that string before writing it to a temp file: temp_file.write(base64.b64encode(base64content))

Based on a trial I believe that this should be a base64decode into the temp file otherwise you will have a double base64 encoded file uploaded as an artifact instead of the raw file itself.

Is this intended?

Describe How to Reproduce

This can be seen by using the stock / default version of fn_utils and sending the file content as base64 (which the function requests). It uploads the file as an artifact which is double base64 encoded instead of being the actual file content.

Believe it should be this: temp_file.write(base64.b64decode(base64content))

breid1313 commented 4 years ago

Which version of fn_utilities are you using?

backcountryinfosec commented 4 years ago

We're using fn-utilities==1.0.10

breid1313 commented 4 years ago

Are you able to upgrade to the latest version and see if the behavior is the same? fn_utilities is up to 1.0.15 now on the App Exchange

backcountryinfosec commented 4 years ago

@breid1313 I'll give that a shot and let you know if the issue persists.

breid1313 commented 4 years ago

@backcountryinfosec looks like this is still an issue in 1.0.15, but is addressed in upcoming release 2.0.0

backcountryinfosec commented 4 years ago

@breid1313 Awesome, that's great to hear. We hadn't gotten a chance to upgrade yet so we will keep that in mind as we do so.

breid1313 commented 4 years ago

Hey @backcountryinfosec I'm going to close this since we are aware of the bug and it's fixed in an upcoming release. Thanks for the feedback!