scVENUS / PeekabooAV

Peekaboo Extended Email Attachment Behavior Observation Owl
https://peekabooav.de
GNU General Public License v3.0
66 stars 20 forks source link

Validation error with dummy filereport and expression referencing type_as_text #176

Closed michaelweiser closed 2 years ago

michaelweiser commented 4 years ago

Similar to #156, startup of Peekaboo fails with certain operators such as in because the dummy filereport's properties return None. Example expression:

"foo" in filereport.type_as_text -> ignore

Error message:

Traceback (most recent call last):
  File "/opt/peekaboo/bin/peekaboo", line 8, in <module>
    sys.exit(run())
  File "/opt/peekaboo/local/lib/python3.6/site-packages/peekaboo/daemon.py", line 364, in run
    engine = RulesetEngine(ruleset_config, db_con)
  File "/opt/peekaboo/local/lib/python3.6/site-packages/peekaboo/ruleset/engine.py", line 106, in __init__
    rule = rule_classes[rule](config, db_con)
  File "/opt/peekaboo/local/lib/python3.6/site-packages/peekaboo/ruleset/rules.py", line 58, in __init__
    self.get_config()
  File "/opt/peekaboo/local/lib/python3.6/site-packages/peekaboo/ruleset/rules.py", line 552, in get_config
    rule.eval(context=context)
  File "/opt/peekaboo/local/lib/python3.6/site-packages/peekaboo/ruleset/expressions.py", line 341, in eval
    ret = self.value[0].eval(context)
  File "/opt/peekaboo/local/lib/python3.6/site-packages/peekaboo/ruleset/expressions.py", line 452, in eval
    val1 = self.value[0].eval(context)
  File "/opt/peekaboo/local/lib/python3.6/site-packages/peekaboo/ruleset/expressions.py", line 457, in eval
    if not self.handle_regexes(function, val1, val2):
  File "/opt/peekaboo/local/lib/python3.6/site-packages/peekaboo/ruleset/expressions.py", line 449, in handle_regexes
    return function(val1, val2)
  File "/opt/peekaboo/local/lib/python3.6/site-packages/peekaboo/ruleset/expressions.py", line 419, in in_
    return a in b
TypeError: argument of type 'NoneType' is not iterable

I guess, eiither our dummies need to get more realistic or we need to scale back the level of evaluation we're doing against them.