[Bug] Tags gets wrong renamed

[crackytsi]

Bug

Work Environment

Question	Answer
OS version (server)	Debian
OS version (client)	10
TheHive version / git hash	4 RC3
Package Type	DEB

Problem Description

I have a tag like this:Id:7SeUoB3IBABD+tMh2PjVJYg==
Note the ":" and the 2 "=" characters.
If I set this tag manually on a case or if I run the migration script importing a case with this tag, it becomes:
Id.7SeUoB3IBABD+tMh2PjVJYg="="
This is not what is expected.

Please encode / preserve the tag is it is.

[To-om]

Tags are decomposed into: namespace, predicate and value. This will permit a soft transition to taxonomies.
When a string is provided, TheHive try to find the 3 components with the following format:

([^\".:=]+)[.:]([\".=]+)=\"([^\"]+)\"#(\\p{XDigit}{6})
([^\".:=]+)[.:]([^\".=]+)=\"?([^\"]+)\"?
([^\".:=]+)[.:]([^\".=]+)
([^\".:=]+)=\"([^\"]+)\"
([^\".:=]+)

In your case, Id becomes the namespace, 7SeUoB3IBABD+tMh2PjVJYg the predicate and = the value. Is it an option to enter Id=7SeUoB3IBABD+tMh2PjVJYg== instead ?

[crackytsi]

Hi,
I don't understand, why this issue didn't exist on TheHive3.
Actually I have a lot of tags that are in the format "XX: asdfadsfads", so this would be a bigger change for me.
I also have no clue how to deal in the migration with this. As it would break a lot of existing things (reports, dashboards etc.)

And would "Id: XXXXX==" work?

[To-om]

I can fix tag parsing for this format. Have you other tag formats that are incorrectly parsed ?

[crackytsi]

On Case-level all my cases have Tags like "id:XXX".
Some have at the end of XXX can be at the end one or 2 characters with "==" e.g. "Id:.7YTkXEBABCETVxKTcUhwQ=="

I also observed that on Observable level, that all tags are "wrong".
They have "Key: Value"-Format (key-dubblepoint-space-value) and become "Key. Value".
Some have the format "Key: A.B.C.D", they are correct, some have the format "Key: Text_A.B.C.D", they are also correct.

[To-om]

This should cover all your cases (cf. https://github.com/TheHive-Project/TheHive/blob/develop-th4/thehive/test/org/thp/thehive/models/TagTest.scala)

[crackytsi]

@To-om
Unforunately I still have some tags thar are wrong:

Here some examples:
Module:atest_blah_blah ==> Module.atest_blah_blah
caOut:/Success ==> caOut./Success
DevProduct:apache ==> DevProduct.apache
Prot:TCP ==> Prot.TCP
dPort:42147 ==> dPort.42147