Error when ingesting a File object with a too big integer in the size field

[gkallenborn]

Description

I am working on an import connector which ingests File objects into OpenCTI. It works quite fine, but when the size field is too big, the ingestion fails. I got the following error message:

{'name': 'Variable "$StixFile" got invalid value 2945216659 at "StixFile.size"; Int cannot represent non 32-bit signed integer value: 2945216659', 'message': 'Variable "$StixFile" got invalid value 2945216659 at "StixFile.size"; Int cannot represent non 32-bit signed integer value: 2945216659'}

The created File object sent to OpenCTI in the STIX bundle was as follows:

"File object: {\"type\": \"file\", \"spec_version\": \"2.1\", \"id\": \"file--37e7013e-9425-59ac-bda4-f2d905bf9714\", \"hashes\": {\"MD5\": \"c0c627aca767007df499630de3d19cec\", \"SHA-1\": \"51c3f6dc2af41688819adc20cf95ea0f1110ec1e\", \"SHA-256\": \"30b9cce3916958e1a1d57e1513af40c8891daadab16fc7ab6fcab1392efaa060\"}, \"size\": 2945216659, \"name\": \"MMD CLOUD PRIVATE.rar\", \"object_marking_refs\": [\"marking-definition--f88d31f6-486f-44da-b317-01333bde0b82\"], \"created_by_ref\": \"identity--0a225431-f1d7-5e77-99fc-6f5d392b92d9\"}"}

Environment

1. OS (where OpenCTI server runs): { e.g. Mac OS 10, Windows 10, Ubuntu 16.4, etc. }
2. OpenCTI version: { e.g. OpenCTI 1.0.2 }
3. OpenCTI client: { e.g. frontend or python }
4. Other environment details:

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Develop an import connector that ingests File objects
2. Choose "2945216659" for the size field
3. Wait for the error message

Expected Output

File object ingested

Actual Output

Error message (see above)

[helene-nguyen]

Hello @gkallenborn,
This error is a GraphQL error. GraphQL doesn't support integers larger than 32 bits as the error indicates because they decided to restrict to signed 32-bit range for Integer by default.

For more details, you can check the link below:

• https://spec.graphql.org/June2018/#sec-Int

There's also a "Long" type available or a custom type but not implemented from my knowledge.

As it is not a connector issue, I suggest you to open a Github issue on OpenCTI project, you can link this issue on your ticket.

I close this issue but it can be re-opened if needed :)