Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Deleted asset should not be accessible via REST #623

Open
wants to merge 12 commits into
base: develop
Choose a base branch
from

Conversation

c8y3
Copy link
Contributor

@c8y3 c8y3 commented Oct 18, 2024

The goal of this PR was to fix the following regression: after an asset was deleted, it was not anymore in the list of assets of the case, but was still accessible with its identifier.
This problem was made visible because we don't rely on both the asset identifier and case identifier to retrieve an asset anymore. But, there was still some unexpected behavior in the existing code.
More specifically here https://github.com/dfir-iris/iris-web/blob/v2.4.14/source/app/datamgmt/case/case_assets_db.py#L128, case_asset.alerts is always different from None (because it is an empty list), and the asset was never really removed from the assets data table. Only it's case_id was set to null. (the code from here https://github.com/dfir-iris/iris-web/blob/v2.4.14/source/app/datamgmt/case/case_assets_db.py#L138, was never reachable)

I decided to always remove the asset completely. I am not sure this can have side-effects somewhere. I tried to explore all possible scenarios and made multiple tests. I made this fix in an isolated PR, so that you can fix in some other way, if necessary. The test scenarios will still be useful.
Also, this was the occasion to fix a missing case for IOC deletion.

The new tests cover these scenarios:

  • test_get_asset_should_return_404_after_it_was_deleted
  • test_delete_asset_should_increment_asset_state
  • test_delele_asset_should_not_fail_when_it_is_linked_to_an_ioc
  • test_delete_asset_should_not_fail_when_it_has_associated_comments
  • test_delete_asset_should_delete_associated_comments
  • test_delete_ioc_should_not_prevent_case_deletion

@c8y3 c8y3 added the bug Something isn't working label Oct 18, 2024
@c8y3 c8y3 requested a review from whikernel October 18, 2024 14:20
@c8y3 c8y3 changed the title Deleted asset should not be visible Deleted asset should not be accessible via REST Oct 18, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant