Skip to content

fix: [client] Post freetext import to events/freeTextImport not attributes/ - #20

Draft
elhoim wants to merge 1 commit into
MISP:mainfrom
elhoim:fix/freetext
Draft

elhoim wants to merge 1 commit into
MISP:mainfrom
elhoim:fix/freetext

Conversation

@elhoim

@elhoim elhoim commented Sep 3, 2026 •

Copy link
Copy Markdown
Contributor

BLUF — Freetext import posted to the wrong controller; it now targets events/freeTextImport/{id}.

  • Problem — MispClient::freetext() in src/client.rs POSTed to attributes/freeTextImport/{event_id}, but freeTextImport is an EventsController action and AttributesController has no such route.
  • Fix — Changes the path to events/freeTextImport/{event_id}, matching MISP core and PyMISP; the body shape was already correct. Adds a wiremock test asserting the path and exact body.
  • Effect — Freetext import reaches the server instead of hitting a dead route, so pasted indicators land on the event.
  • CI — Red from a known repo CI bug (an ubuntu-22.04 runner with no php8.3 mod_php, plus a publish-worker race in test_event_crud_lifecycle), fixed in PR fix: [ci] Run integration tests on ubuntu-24.04 to match php8.3 #53 and unrelated to this PR.

Finding

freetext posts to attributes/freeTextImport/{id}; action is on EventsController
AttributesController has no freeTextImport. MISP has EventsController::freeTextImport($id,...); PyMISP uses events/freeTextImport.

Change

MispClient::freetext() in src/client.rs was POSTing to attributes/freeTextImport/{event_id}, but freeTextImport is an EventsController action, not AttributesController. Changed the path to events/freeTextImport/{event_id}, matching MISP core and PyMISP. The request body shape (value/adhereToWarninglists/distribution) was already correct, so no body change was needed.

Upstream evidence

MISP core app/Controller/EventsController.php:6105 public function freeTextImport($id, $adhereToWarninglists = false, $returnMetaAttributes = false) (on EventsController, not AttributesController), and line 6559 'url' => $this->baseurl . '/events/freeTextImport/' . $id confirming the route. PyMISP pymisp/api.py:3578 r = self._prepare_request('POST', f'events/freeTextImport/{event_id}', data=query, **kwargs).

Verified against MISP core 843b6744 and PyMISP e7debb4f.

Tests

  • client::tests::freetext_posts_to_events_endpoint (new wiremock test in src/client.rs asserting POST path /events/freeTextImport/42 and exact request body {value, adhereToWarninglists, distribution}; fails against the pre-fix path attributes/freeTextImport/42 since wiremock returns 404 for an unmatched path/body combo)

Verified locally: cargo fmt --check, cargo clippy --all-targets --all-features -- -D warnings, cargo test --all-features --lib, --test integration_tests --no-run, and cargo check --examples, each in an isolated target directory.

🤖 Generated with Claude Code

…butes/

MispClient::freetext() posted to attributes/freeTextImport/{event_id}, but
AttributesController has no such action. The freeTextImport action lives on
EventsController and is routed at events/freeTextImport/{id}
(misp/app/Controller/EventsController.php:6105 `public function
freeTextImport($id, $adhereToWarninglists = false, $returnMetaAttributes =
false)`, referenced again at line 6559 as
`$this->baseurl . '/events/freeTextImport/' . $id`). PyMISP posts to the
same path (pymisp/pymisp/api.py:3578
`f'events/freeTextImport/{event_id}'`).

The request body shape (value/adhereToWarninglists/distribution) already
matched the controller and PyMISP's query dict, so only the path needed
correcting.

Added a wiremock test (freetext_posts_to_events_endpoint) asserting both
the corrected path and the request body, since no prior test covered this
method.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JoSButbVaWEtGMXwTx73BZ
@elhoim
elhoim marked this pull request as draft September 3, 2026 05:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant