CERT-Polska/mwdb-core

Attribute searching: search strings lexicographically

Closed this issue · 2 comments

Hey!

This might have been a change in the recent search refactoring, but this query for a string attribute results in an error:
image

However, comparing strings lexicographically does make sense in some cases. For example, if the strings are ISO 8601 format dates

Edit: I think this isn't an issue with the string comparison, but with the - in the string.

🤔 Yeah, I think it's more a bug. Search like that is converted to the jsonpath query value @? '$.vt.last_analysis_str ? @ <= 2024-07-07 because I assumed that range queries can be done only with numerical values. Unfortunately that assumption doesn't come with any validation.

If lexicographical compare works with jsonpath, I think it's just enough to add quotes and proper escapes when queried value doesn't look like a number (using jsonpath_quote -

def jsonpath_quote(value: str) -> str:
). Of course there will be still a corner case with numbers represented as strings, but I guess it's not that important.

I'll try to fix that soon!