Deleted asset should not be accessible via REST #623
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The goal of this PR was to fix the following regression: after an asset was deleted, it was not anymore in the list of assets of the case, but was still accessible with its identifier.
This problem was made visible because we don't rely on both the asset identifier and case identifier to retrieve an asset anymore. But, there was still some unexpected behavior in the existing code.
More specifically here https://github.com/dfir-iris/iris-web/blob/v2.4.14/source/app/datamgmt/case/case_assets_db.py#L128, case_asset.alerts is always different from None (because it is an empty list), and the asset was never really removed from the assets data table. Only it's case_id was set to null. (the code from here https://github.com/dfir-iris/iris-web/blob/v2.4.14/source/app/datamgmt/case/case_assets_db.py#L138, was never reachable)
I decided to always remove the asset completely. I am not sure this can have side-effects somewhere. I tried to explore all possible scenarios and made multiple tests. I made this fix in an isolated PR, so that you can fix in some other way, if necessary. The test scenarios will still be useful.
Also, this was the occasion to fix a missing case for IOC deletion.
The new tests cover these scenarios: