[high] fix: [malshare_upload] avoid KeyError when config is missing - #884
Open
elhoim wants to merge 1 commit into
Open
[high] fix: [malshare_upload] avoid KeyError when config is missing#884elhoim wants to merge 1 commit into
elhoim wants to merge 1 commit into
Conversation
handler() checked request["config"].get("malshare_apikey") to decide whether
to report the friendly "Missing MalShare API key" error, but indexing
request["config"] directly raises a KeyError when the request has no
"config" key at all (e.g. the module is invoked before any configuration is
set). Instead of returning the intended misperrors message, the module
crashes with an unhandled exception.
Use request.get("config") or {} so a missing config dict falls back to an
empty one and the existing API-key check reports the expected error instead
of raising.
Verified with flake8 (clean) and the full pytest suite against a local
misp-modules server on port 6775: 161 passed, 4 skipped, 5 subtests passed,
matching the baseline.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018dfYpyaSZd1nxSRLr8suj8
elhoim
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
BLUF —
malshare_upload.pyraisesKeyErroron a config-less request instead of its missing-key message.malshare_upload.pyindexesrequest["config"]directly, so a request carrying noconfigkey at all raises an unhandledKeyErrorinstead of the module's intended "Missing MalShare API key" message.(request.get("config") or {}).get("malshare_apikey")so the friendly error is returned.Direct indexing into
request["config"]raises aKeyErrorwhenever the incoming request has no"config"key at all, instead of returning the module's intended friendly error message"Missing MalShare API key".Impact: An analyst who invokes the
malshare_uploadexpansion module without any configuration (e.g. no MalShare API key set up in MISP module settings, soconfigis entirely absent from the request) gets an unhandledKeyErrortraceback surfaced back through MISP instead of a clear "Missing MalShare API key" error explaining what to fix.Fix: Changed the lookup to
(request.get("config") or {}).get("malshare_apikey"), which falls back to an empty dict when"config"is missing, so the friendly error message is returned as intended.Verification
flake8 misp_modules/modules/expansion/malshare_upload.py— clean (no output)161 passed, 4 skipped, 5 subtests passed in 25.92sFound during a review of the repository; other findings are being submitted as separate PRs.
🤖 Generated with Claude Code