fix: [vt_graph_parser] split filename|hash on the last pipe - #893
Open
elhoim wants to merge 1 commit into
Open
Conversation
MispAttribute's constructor splits a `filename|hash` MISP attribute value
with a plain `value.split("|")`, which raises ValueError as soon as it
returns more than two parts. Any filename that itself contains a `|`
character (a legitimate byte in a filename) therefore aborts the whole
VT Graph export instead of exporting the attribute. The hash suffix is
always a single trailing token with no `|` in it, so splitting from the
right on the last pipe correctly separates an arbitrary filename from
the hash regardless of how many `|` characters the filename contains.
Verified with py_compile on the changed file and the full pytest suite
against a live modules server on port 6785: 161 passed, 4 skipped, 5
subtests passed, matching the documented baseline.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018dfYpyaSZd1nxSRLr8suj8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The defect
MispAttribute.__init__inmisp_modules/lib/vt_graph_parser/helpers/wrappers.pysplits afilename|hashMISP attribute value on|with no limit.str.split("|")on a value likereport|final|v1.exe|44d88612fea8a8f36de82e1278abb02freturns more than two elements, and unpacking that intolabel, valueraisesValueError: too many values to unpack, which aborts the entire VT Graph export.Impact
Any MISP analyst exporting a
filename|md5/filename|sha1/filename|sha256composite attribute to VirusTotal Graph fails outright as soon as the filename itself contains a pipe character (a legal, unremarkable character in a filename). The whole export errors instead of just handling that one attribute.The fix
Changed the split to
value.rsplit("|", 1), splitting from the right so only the trailing hash token (which never contains|) is separated off, regardless of how many|characters appear in the filename portion.No behaviour change for the common case (filenames without
|); this only fixes the crash for filenames containing|.Verification
py_compileclean on the changed file (it lives undermisp_modules/lib/, so flake8's CI exclusions do not apply to it).Found during a review of the repository; other findings are being submitted as separate PRs.
🤖 Generated with Claude Code
https://claude.ai/code/session_018dfYpyaSZd1nxSRLr8suj8