TypeError: must be str, not NoneType in getEmailBody

[ddaniele]

I got this error when trying to sync exchange email.

File "/opt/Synapse/workflows/Ews2Case.py", line 164, in getEmailBody
return ('\n' + replyToInfo + body + '\n')
TypeError: must be str, not NoneType

I modify Ews2case.py code to return "... str(body)..." and worked.
Can anyone confirm if it is correct?.

Thanks in advance.

[ninSmith]

Hey,

Can you give more details ?
Are you using exchange on premises, O365 ?
Was the email body empty ?

[ddaniele]

I'm using Exchange 2010 OnPrem and the body was not empty.
thx.

[ninSmith]

Can you give me more details about the body ?
Was it pure text, html, a picture mixed with html ?

[ddaniele]

yes, we use rich text as format... picture mixed with html.
If it possible add some debug to Ews2case.py and I can paste the output.
thx

[ninSmith]

Actually I would rather need the email itself.
Do you think you could share it ? If so, please send the email to our support email address please.

[arnydo]

Same issue here. How would you like me to provide a sample email to you?

[arnydo]

I used the BeautifulSoup method and it successfully parsed the body of HTML, Rich and Plain Text emails.

[ninSmith]

Could you send me the email at support[@]thehive-project[.]org

Thanks

[arnydo]

Could you send me the email at support[@]thehive-project[.]org

Thanks

@ninSmith You can use the two emails I emailed you yesterday. Both of those were successfully parsed by Synapse and sent to TheHive.

[ErnHem]

Hi All,

Have the same issue with O365.
The email body is empty but there is an attachment.

2018-12-14 18:46:01,200 :: INFO :: workflows.Ews2Case.connectEws starts
2018-12-14 18:46:01,201 :: INFO :: common.common.getConf starts
2018-12-14 18:46:01,201 :: INFO :: objects.EwsConnector. getAccount starts
2018-12-14 18:46:01,202 :: INFO :: objects.EwsConnector.scan starts
2018-12-14 18:46:03,795 :: INFO :: objects.TheHiveConnector.connect starts
2018-12-14 18:46:05,002 :: INFO :: objects.TheHiveConnector.searchCaseByDescription starts
2018-12-14 18:46:05,055 :: INFO :: objects.TheHiveConnector.getTaskIdByName starts
2018-12-14 18:46:05,098 :: ERROR :: Failed to create case from email
Traceback (most recent call last):
File "/opt/Synapse/workflows/Ews2Case.py", line 75, in connectEws
fullBody = getEmailBody(msg)
File "/opt/Synapse/workflows/Ews2Case.py", line 160, in getEmailBody
return ('\n' + replyToInfo + body + '\n')
TypeError: Can't convert 'NoneType' object to str implicitly

[ErnHem]

As a temporary solution, I've added
if body is None: body = ''
in Synapse/workflows/Ews2Case.py after 149th line
body = email.text_body
and now it's working.

[ninSmith]

I tried to address this issue in the branch https://github.com/TheHive-Project/Synapse/tree/feature/4
Could one of you try my fix as I'm not able to reproduce the "empty body email" ?

Thanks in advance

[jdepalma]

@ninSmith I experienced the same issue as the others as I run Exchange 2010.
With the inclusion of "from bs4 import BeautifulSoup" your fix worked great.

Now, how can we go about getting the URLs as observables? I have written something before that parses my messages and grabs urls and sends off to CISCO. Not sure how to incorporate such logic with TheHive though.

Great job btw. I've been access email messages a very different way. Learned much.