Fix include_similar=false being treated as enabled in command_sequence endpoint. Closes #1270#1283
Closed
Vipeen-Kumar wants to merge 1 commit intoGreedyBear-Project:mainfrom
Closed
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Fixes boolean parsing for the include_similar query parameter in the command_sequence API so that include_similar=false (and other non-true values) no longer enable similar-sequence expansion, aligning behavior with the cowrie_session endpoint.
Changes:
- Update
command_sequenceto treatinclude_similaras enabled only when its value is case-insensitive"true". - Add tests covering
include_similar=false,include_similar=true, and case-insensitive"TRUE"/"True"behavior.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
api/views/command_sequence.py |
Switches include_similar parsing from “presence-based” to explicit boolean "true" semantics. |
tests/api/views/test_command_sequence_view.py |
Adds parameter-validation tests to prevent regressions in include_similar parsing/behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
47
to
49
| observable = request.query_params.get("query") | ||
| include_similar = request.query_params.get("include_similar") is not None | ||
| include_similar = request.query_params.get("include_similar", "false").lower() == "true" | ||
| logger.info(f"Command Sequence view requested by {request.user} for {observable}") |
Comment on lines
+57
to
+63
| # # # # # Parameter Validation Tests # # # # # | ||
| def test_include_similar_false_value(self): | ||
| """Test that include_similar=false behaves like missing include_similar.""" | ||
| base_response = self.client.get("/api/command_sequence?query=140.246.171.141") | ||
| self.assertEqual(base_response.status_code, 200) | ||
|
|
||
| false_response = self.client.get("/api/command_sequence?query=140.246.171.141&include_similar=false") |
Comment on lines
+68
to
+78
| def test_include_similar_true_expands_results(self): | ||
| """Test that include_similar=true returns a superset (or equal set) of base results.""" | ||
| base_response = self.client.get("/api/command_sequence?query=140.246.171.141") | ||
| self.assertEqual(base_response.status_code, 200) | ||
| base_executed_by = set(base_response.data["executed_by"]) | ||
|
|
||
| true_response = self.client.get("/api/command_sequence?query=140.246.171.141&include_similar=true") | ||
| self.assertEqual(true_response.status_code, 200) | ||
| true_executed_by = set(true_response.data["executed_by"]) | ||
|
|
||
| self.assertTrue(base_executed_by.issubset(true_executed_by)) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR fixes a bug in the
command_sequenceendpoint where theinclude_similarparameter was evaluated based on its presence rather than its value. Previously, requests like?include_similar=falsewould incorrectly trigger similar sequence expansion.The parsing logic has been updated to explicitly check for a truthy value, aligning behavior with
cowrie_session.py.Additional tests were added to cover:
include_similar=falseinclude_similar=trueTRUE,True)Related issues
Closes #1270
Type of change
Checklist
Formalities
develop.develop.Docs and tests
Ruff) gave 0 errors.GUI changes
(Not applicable)