Skip to content

Fix mapping phishing#2576

Merged
fgibertoni merged 2 commits intodevelopfrom
fix-mapping-phishing
Nov 21, 2024
Merged

Fix mapping phishing#2576
fgibertoni merged 2 commits intodevelopfrom
fix-mapping-phishing

Conversation

@fgibertoni
Copy link
Contributor

@fgibertoni fgibertoni commented Nov 21, 2024

(Please add to the PR name the issue/s that this PR would close if merged by using a Github keyword. Example: <feature name>. Closes #999. If your PR is made by a single commit, please add that clause in the commit too. This is all required to automate the closure of related issues.)

Description

Fix bug with creation of mapping and removed parameters from POST as it may lead to wrong results.

Type of change

Please delete options that are not relevant.

  • Bug fix (non-breaking change which fixes an issue).
  • New feature (non-breaking change which adds functionality).
  • Breaking change (fix or feature that would cause existing functionality to not work as expected).

Checklist

  • I have read and understood the rules about how to Contribute to this project
  • The pull request is for the branch develop
  • A new plugin (analyzer, connector, visualizer, playbook, pivot or ingestor) was added or changed, in which case:
    • I strictly followed the documentation "How to create a Plugin"
    • Usage file was updated.
    • Advanced-Usage was updated (in case the plugin provides additional optional configuration).
    • I have dumped the configuration from Django Admin using the dumpplugin command and added it in the project as a data migration. ("How to share a plugin with the community")
    • If a File analyzer was added and it supports a mimetype which is not already supported, you added a sample of that type inside the archive test_files.zip and you added the default tests for that mimetype in test_classes.py.
    • If you created a new analyzer and it is free (does not require any API key), please add it in the FREE_TO_USE_ANALYZERS playbook by following this guide.
    • Check if it could make sense to add that analyzer/connector to other freely available playbooks.
    • I have provided the resulting raw JSON of a finished analysis and a screenshot of the results.
    • If the plugin interacts with an external service, I have created an attribute called precisely url that contains this information. This is required for Health Checks.
    • If the plugin requires mocked testing, _monkeypatch() was used in its class to apply the necessary decorators.
    • I have added that raw JSON sample to the MockUpResponse of the _monkeypatch() method. This serves us to provide a valid sample for testing.
  • If external libraries/packages with restrictive licenses were used, they were added in the Legal Notice section.
  • Linters (Black, Flake, Isort) gave 0 errors. If you have correctly installed pre-commit, it does these checks and adjustments on your behalf.
  • I have added tests for the feature/bug I solved (see tests folder). All the tests (new and old ones) gave 0 errors.
  • If changes were made to an existing model/serializer/view, the docs were updated and regenerated (check CONTRIBUTE.md).
  • If the GUI has been modified:
    • I have a provided a screenshot of the result in the PR.
    • I have created new frontend tests for the new component or updated existing ones.
  • After you had submitted the PR, if DeepSource, Django Doctors or other third-party linters have triggered any alerts during the CI checks, I have solved those alerts.

Important Rules

  • If you miss to compile the Checklist properly, your PR won't be reviewed by the maintainers.
  • Everytime you make changes to the PR and you think the work is done, you should explicitly ask for a review. After being reviewed and received a "change request", you should explicitly ask for a review again once you have made the requested changes.

@fgibertoni fgibertoni requested a review from mlodic November 21, 2024 15:30
github-advanced-security[bot]
github-advanced-security bot found potential problems Nov 21, 2024
View reviewed changes
api_app/analyzers_manager/file_analyzers/phishing/phishing_form_compiler.py
upper_case=True,
lower_case=True,
)
logger.info(f"Generated fake password input {self.FAKE_PASSWORD_INPUT}")

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information

This expression logs [sensitive data (password)](1) as clear text.

Copilot Autofix

AI over 1 year ago

The best way to fix the problem is to avoid logging the sensitive information altogether. Instead of logging the actual fake password, we can log a message indicating that a fake password was generated without including the actual value. This way, we maintain the logging functionality without exposing sensitive information.

To implement this fix, we need to modify the logging statements in the config method of the PhishingFormCompiler class. Specifically, we will replace the logging of the actual fake password with a generic message.

Suggested changeset 1
api_app/analyzers_manager/file_analyzers/phishing/phishing_form_compiler.py

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/api_app/analyzers_manager/file_analyzers/phishing/phishing_form_compiler.py b/api_app/analyzers_manager/file_analyzers/phishing/phishing_form_compiler.py
--- a/api_app/analyzers_manager/file_analyzers/phishing/phishing_form_compiler.py
+++ b/api_app/analyzers_manager/file_analyzers/phishing/phishing_form_compiler.py
@@ -94,3 +94,3 @@
         )
-        logger.info(f"Generated fake password input {self.FAKE_PASSWORD_INPUT}")
+        logger.info("Generated fake password input")
         self.FAKE_TEL_INPUT: str = fake.phone_number()
EOF
@@ -94,3 +94,3 @@
)
logger.info(f"Generated fake password input {self.FAKE_PASSWORD_INPUT}")
logger.info("Generated fake password input")
self.FAKE_TEL_INPUT: str = fake.phone_number()
Copilot is powered by AI and may make mistakes. Always verify output.
@fgibertoni fgibertoni merged commit 676c1a4 into develop Nov 21, 2024
@fgibertoni fgibertoni deleted the fix-mapping-phishing branch November 21, 2024 15:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mlodic mlodic mlodic approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@fgibertoni @mlodic