[backend]Verify createdBy type on malware creation (#6291)

opencti-platform/opencti-graphql/src/database/middleware.js

@@ -108,7 +108,7 @@ import {
   INTERNAL_IDS_ALIASES,
   INTERNAL_PREFIX,
   REL_INDEX_PREFIX,
-  RULE_PREFIX,
+  RULE_PREFIX
 } from '../schema/general';
 import { getParentTypes, isAnId } from '../schema/schemaUtils';
 import {
@@ -141,6 +141,7 @@ import {
   ENTITY_TYPE_CONTAINER_OBSERVED_DATA,
   ENTITY_TYPE_IDENTITY_INDIVIDUAL,
   isStixDomainObject,
+  isStixDomainObjectIdentity,
   isStixDomainObjectShareableContainer,
   isStixObjectAliased,
   resolveAliasesField,
@@ -565,7 +566,32 @@ const idLabel = (label) => {
   return isAnId(label) ? label : generateStandardId(ENTITY_TYPE_LABEL, { value: normalizeName(label) });
 };
 
+/**
+ * Verify that the Entity in createdBy is one of Identity entity.
+ * If not throw functional error to stop creation or update.
+ * @param context
+ * @param user
+ * @param createdById
+ * @returns {Bluebird.Promise<void>}
+ */
+export const validateCreatedBy = async (context, user, createdById) => {
+  if (createdById) {
+    const createdByEntity = await internalLoadById(context, user, createdById);
+    if (createdByEntity && createdByEntity.entity_type) {
+      if (!isStixDomainObjectIdentity(createdByEntity.entity_type)) {
+        throw FunctionalError('CreatedBy relation must be an Identity entity.', {
+          createdBy: createdById
+        });
+      }
+    }
+  }
+};
+
 const inputResolveRefs = async (context, user, input, type, entitySetting) => {
+  if (input.createdBy) {
+    await validateCreatedBy(context, user, input.createdBy);
+  }
+
   const inputResolveRefsFn = async () => {
     const fetchingIds = [];
     const expectedIds = [];

opencti-platform/opencti-graphql/src/domain/stixDomainObject.js

@@ -8,7 +8,8 @@
   storeLoadByIdWithRefs,
   timeSeriesEntities,
   updateAttribute,
-  updateAttributeFromLoadedWithRefs
+  updateAttributeFromLoadedWithRefs,
+  validateCreatedBy
 } from '../database/middleware';
 import { listAllToEntitiesThroughRelations, listEntities, listEntitiesThroughRelationsPaginated, storeLoadById } from '../database/middleware-loader';
 import { elCount, elFindByIds } from '../database/engine';
@@ -200,6 +201,12 @@
   if (!stixDomainObject) {
     throw FunctionalError('Cannot edit the field, Stix-Domain-Object cannot be found.');
   }
+
+  const createdByKey = input.find((inputData) => inputData.key === 'createdBy');
+  if (createdByKey) {
+    await validateCreatedBy(context, user, input.value[0]);
+  }
+
   const { element: updatedElem } = await updateAttribute(context, user, stixObjectId, ABSTRACT_STIX_DOMAIN_OBJECT, input, opts);
   // If indicator is score patched, we also patch the score of all observables attached to the indicator
   if (stixDomainObject.entity_type === ENTITY_TYPE_INDICATOR && input.key === 'x_opencti_score') {

opencti-platform/opencti-graphql/src/domain/stixObjectOrStixRelationship.ts

@@ -4,7 +4,7 @@ import { storeLoadById } from '../database/middleware-loader';
 import { ABSTRACT_STIX_REF_RELATIONSHIP } from '../schema/general';
 import { FunctionalError, UnsupportedError } from '../config/errors';
 import { isStixRefRelationship } from '../schema/stixRefRelationship';
-import { buildRelationData, storeLoadByIdWithRefs, transformPatchToInput, updateAttributeFromLoadedWithRefs } from '../database/middleware';
+import { buildRelationData, storeLoadByIdWithRefs, transformPatchToInput, updateAttributeFromLoadedWithRefs, validateCreatedBy } from '../database/middleware';
 import { notify } from '../database/redis';
 import { BUS_TOPICS } from '../config/conf';
 import type { AuthContext, AuthUser } from '../types/user';
@@ -47,6 +47,11 @@ export const stixObjectOrRelationshipAddRefRelation = async (
   opts = {}
 ): Promise<any> => { // TODO remove any when all resolvers in ts
   const to = await findById(context, user, input.toId);
+
+  if (input.relationship_type === 'created-by') {
+    await validateCreatedBy(context, user, input.toId);
+  }
+
   const patchedFrom = await patchElementWithRefRelationships(context, user, stixObjectOrRelationshipId, type, input.relationship_type, [input.toId], UPDATE_OPERATION_ADD, opts);
   const { element: refRelation } = await buildRelationData(context, user, { from: patchedFrom, to, relationship_type: input.relationship_type });
   await notify(BUS_TOPICS[type as BusTopicsKeyType].EDIT_TOPIC, refRelation, user);