rapid7 / nexpose-client-python

DEPRECATED : Rapid7 Nexpose API client library written in Python
https://www.rapid7.com/
BSD 3-Clause "New" or "Revised" License
25 stars 20 forks source link

Saving a site with tags tries to pass CREATION_DATE and throws an exception #22

Open derpadoo opened 7 years ago

derpadoo commented 7 years ago

Along with my other commits, experimenting with saving sites that have tags since they are deleted when re-saving the site.

Expected Behavior

Should pull existing site tags and save them back to site.

Current Behavior

Uncommented the "print as_string(as_xml(as_string(xml_data)))" in nexpose_site.py to view the XML data.

It tries to save a tag with the format:

<Tags><Tag id="15" name="MYTAG" type="CUSTOM"><param name="COLOR" value="#a0392e"/><param name="SOURCE" value="Nexpose"/><param name="CREATOR_USER_ID" value="1"/><param name="CREATION_DATE" value="Thu Feb 20 13:02:01 CDT 2017"/></Tag></Tags>

and I narrowed it down to throwing an exception on the CREATION_DATE

EXCEPTION: For input string: "Thu Feb 20 13:02:01 CDT 2017"

Possible Solution

I don't know how it is pulling the "param" variables and are not experienced enough to parse the lxml object and remove them. Maybe the time format is wrong?

Steps to Reproduce (for bugs)

Python code that reproduces the issue...I can provide a PR of that would help. Updated nexpose_site.py

def CreateFromXML(xml_data):
        config = SiteConfiguration()
        config.InitalizeFromXML(xml_data)
        config.description = get_content_of(xml_data, 'Description', config.description)
        config.is_dynamic = get_attribute(xml_data, 'isDynamic', config.is_dynamic) in ['1', 'true', True]
        config.hosts = [_host_to_object(host) for host in get_children_of(xml_data, 'Hosts')]
        config.alerting = [alert for alert in get_children_of(xml_data, 'Alerting')]
        config.credentials = [credential for credential in get_children_of(xml_data, 'Credentials')]
        config.users = [user for user in get_children_of(xml_data, 'Users')]
        config.tags = [tag for tag in get_children_of(xml_data, 'Tags')]
.
.
.
def __init__(self):
        SiteBase.__init__(self)
        self.description = ''
        self.is_dynamic = False
        self.hosts = []
        self.credentials = []
        self.alerting = []
        self.scan_configuration = []  # TODO
        self.configid = self.id
        self.configtemplateid = "full-audit-without-web-spider"
        self.configname = "Full audit without Web Spider"
        self.configversion = 3
        self.configengineid = 3
        self.users = []
        self.schedules = []
        self.tags = []
.
.
.
    def AsXML(self, exclude_id):
        attributes = {}
        if not exclude_id:
            attributes['id'] = self.id
        attributes['name'] = self.name
        attributes['description'] = self.short_description
        attributes['isDynamic'] = '1' if self.is_dynamic else '0'
        attributes['riskfactor'] = self.risk_factor
.
.
.
        xml_tags = create_element('Tags')
        for tag in self.tags:
            xml_tags.append(tag)
        xml_data.append(xml_tags)

Context

Trying to save a site and keep the existing tags.

Your Environment

gschneider-r7 commented 7 years ago

It looks like the date needs to be in unix timestamp format (seconds), i.e. long value according to the Nexpose API. It's not symmetrical, though, so I would argue this is just as much a bug in the Nexpose API itself since the formatted date is coming from Nexpose API itself.

derpadoo commented 7 years ago

Do you know how to access that variable to perhaps modify it before sending it back? All I can retrieve are the children of Tags which consist of id="15" name="MYTAG" type="CUSTOM". I can't figure out how to access the "param" variables yet.

gschneider-r7 commented 7 years ago

The params are children elements of each tag, so would have to iterate on them until finding the one with name CREATION_DATE and then modify the value.

<Tags>
  <Tag id="15" name="MYTAG" type="CUSTOM">
    <param name="CREATION_DATE" value="..."/>
    <param name="COLOR" value="..."/>
    <param ... />
  </Tag>
</Tags>