events/edit API readds deleted attributes already returned by a search

[mike1703]

Steps to reproduce:

• fetch an event (with id: event_id) with my_event = misp.search()
• delete some attributes from event_id
• add an attribute with misp.add_attribute(my_event, )
  => the deleted attributes are recreated as they are still included in my_event

workaround:
set my_event['Event']['Attribute'] = [ ] before adding any new attributes.

possible fixes:

• create a different API which supports deltas which can be uploaded in one go
• on adding an attribute do not resend the old attributes

[Rafiot]

Just to make sure you use the same path I'd be using (pseudocode):

misp = PyMISP(...)
e = misp.search('foobar')
# delete attributes from e 
misp.add_named_attribute(e, ...)

You're right, all the deleted attributes will be back. I think the easy and clean fix is to set the attributes list to [] in add_named_attribute.

Never mind, this pseudo code should work (https://github.com/MISP/PyMISP/blob/master/pymisp/api.py#L379). How do you delete the attributes?

[mike1703]

I am deleting them with misp.delete_attribute(attribute_id).
The problem is that the following code in _send_attributes just takes your event event = misp.search('foobar'), parses it (so it is based on the event MISP returned to me as a result for the search, adds my new attributes and updates the event. Old attributes are still sent with the event. e.attributes = attributes would be a fix. I just don't know if it will break something else.
https://github.com/MISP/PyMISP/blob/master/pymisp/api.py#L378

e = MISPEvent(self.describe_types)
            e.load(event)
            e.attributes += attributes
            response = self.update_event(event['Event']['id'], json.dumps(e, cls=EncodeUpdate))

[Rafiot]

I'll work on a fix asap. Expect it to be fixed early next year.

[Rafiot]

Current master let you mark an attribute as deleted. This is the cleanest way to do it.

Can you give a try and tell me if it is fine for you.