Ews header deduplication bug

[content-bot]

Original External PR

external pull request

Contributor

@ieichen137

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

• In Progress
• Ready
• In Hold - (Reason for hold)

Related Issues

fixes: link to the issue

Description

This is a quick bug fix for the recent additions to the EWS_0365 which added the rfc compliant specifications along with the header deduplication prevention.

We just had one email come through where the DATE header value stored in the O365 object was different than the value stored in the EML bytes.

When parsing using the python email library, since when using the SMTP and SMTPUTF8 policies, some headers have specific restrictions on how many can be included. DATE has a restriction of 1, and since the header deduplication works off key/value pair, as some headers can and should appear more than once, the DATE header was attempted to be added again with the altered value from the microsoft api data, which threw this uncaught exception.

This change adds a simple try/except around the add_header call to catch this specific error:

 ValueError: There may be at most <n> <header name> headers in a message

where is the limit and

is the name of the header.

the exception logic is this:

...
try:
    email_content.add_header(header.name, header.value)
except ValueError as err:
    if "There may be at most" not in str(err):
        raise err

Which will catch a value error and check if it matches the error message for this problem. If it does, the function will continue as normal. If it does not, the error is raised.

Must have

• Tests
• Documentation

[github-actions]

Coverage Report

File	Stmts	Miss	Cover	Missing
Packs/MicrosoftExchangeOnline/Integrations/EWSO365
EWSO365.py	382	83	78%	138–139, 149–150, 247–249, 281–284, 324–325, 327–328, 330, 368–370, 405, 410–413, 438, 457–458, 465–466, 478, 503–507, 515–516, 601–603, 615–618, 620, 638, 640, 704, 715, 890–891, 895, 930–933, 1447, 1607–1609, 1660–1661, 1781, 1827, 2290–2292, 2295, 2303, 2340–2349, 2368, 2599–2600, 2623
TOTAL	382	83	78%

Tests	Skipped	Failures	Errors	Time
39	0 💤	0 ❌	0 🔥	3.108s ⏱️