falcon.Submit(body=body) Revisited...

[bp4151]

Hey folks,

So I have been refactoring my code again and am running into something odd. I am calling UploadSampleV3, checking the response for success, and immediately calling Submit. I am calling the OAuth2 endpoint up front to get my token and passing the token in to both calls. It works with UploadSampleV3, but when I call Submit, I am getting a 403 no matter what I try.

Code is below. I am not sure if I am missing something (English as a First Language/Synaptic Deficiency/Cranio-Rectal Inversion issues) or if it's something else. I am assuming from the docs that I should be calling /falconx/entities/submissions/v1 which I also assume is the Submit call. If anyone could please assist, I'd greatly appreciate it.

def upload_file(token: str, full_file_path: str, is_docker: bool) -> object:
    file_name = full_file_path.split('\\')[-1]

    if is_docker:
        full_file_path = os.path.join(os.getcwd(), "files", file_name)
        if not os.path.exists(full_file_path):
            raise FileNotFoundError

    falcon_sample = FalconSamples.Sample_Uploads(access_token=token)

    headers = {
        'accept': 'application/json',
        'Content-Type': 'application/octet-stream'
    }

    params = {
        'file_name': file_name,
        'is_confidential': True
    }

    body = {
        "Body Payload": open(full_file_path, 'rb').read()
    }

    file_data = open(full_file_path, 'rb').read()

    response = falcon_sample.UploadSampleV3(parameters=params, body=body, file_name=file_name, file_data=file_data)

    return response


def submit_file(token: str, sha256_value: str, environment_id: int) -> object:
    falcon_sandbox = FalconSandbox.FalconX_Sandbox(access_token=token)

    body = {
        "sandbox": [{
            "sha256": sha256_value,
            "environment_id": environment_id
        }]
    }
    falcon_sandbox.headers["Content-Type"] = "application/json"

    response = falcon_sandbox.Submit(body=body)
    return response

[jshcodes]

Hi @bp4151!

Give this a try and let us know what you get back.

Side note: I did not have to make changes to your two methods. (But I did remove the unnecessary header dictionary and tweaked the imports a little.)

import os
import json
from falconpy.sample_uploads import Sample_Uploads
from falconpy.falconx_sandbox import FalconX_Sandbox
from falconpy.oauth2 import OAuth2


def upload_file(token: str, full_file_path: str, is_docker: bool) -> object:
    file_name = full_file_path.split('\\')[-1]

    if is_docker:
        full_file_path = os.path.join(os.getcwd(), "files", file_name)
        if not os.path.exists(full_file_path):
            raise FileNotFoundError

    falcon_sample = Sample_Uploads(access_token=token)

    params = {
        'file_name': file_name,
        'is_confidential': True
    }

    body = {
        "Body Payload": open(full_file_path, 'rb').read()
    }

    file_data = open(full_file_path, 'rb').read()

    response = falcon_sample.UploadSampleV3(parameters=params, body=body, file_name=file_name, file_data=file_data)

    return response


def submit_file(token: str, sha256_value: str, environment_id: int) -> object:
    falcon_sandbox = FalconX_Sandbox(access_token=token)

    body = {
        "sandbox": [{
            "sha256": sha256_value,
            "environment_id": environment_id
        }]
    }
    falcon_sandbox.headers["Content-Type"] = "application/json"

    response = falcon_sandbox.Submit(body=body)
    return response


with open("config.json", "r") as cred_file:
    config = json.loads(cred_file.read())
creds = {
    "client_id": config["falcon_client_id"],
    "client_secret": config["falcon_client_secret"]
}

# Connect to the API
falcon = OAuth2(creds=creds)
# Get a token
token = falcon.token()["body"]["access_token"]
# Upload a cool picture of my car
upload_result = upload_file(token, "testfile.jpg", False)
# Send it to the Sandbox - I chose Linux for my sandbox environment
submit_result = submit_file(token, upload_result["body"]["resources"][0]["sha256"], 300)

This returns the following result in my test CID:

{
	"status_code": 200,
	"headers": {
		"Content-Encoding": "gzip",
		"Content-Length": "398",
		"Content-Type": "application/json",
		"Date": "Fri, 23 Jul 2021 23:58:14 GMT",
		"Strict-Transport-Security": "max-age=15724800; includeSubDomains",
		"X-Cs-Region": "us-1",
		"X-Cs-Traceid": "37c7c259-SOMETHING-SOMETHING-SOMETHING-DARKSIDE",
		"X-Ratelimit-Limit": "6000",
		"X-Ratelimit-Remaining": "5997"
	},
	"body": {
		"meta": {
			"query_time": 0.236588194,
			"powered_by": "falconx-api",
			"trace_id": "37c7c259-SOMETHING-SOMETHING-SOMETHING-DARKSIDE",
			"quota": {
				"total": 300,
				"used": 0,
				"in_progress": 1
			}
		},
		"resources": [{
			"id": "797REDACTED",
			"cid": "797REDACTED",
			"origin": "apigateway",
			"state": "created",
			"created_timestamp": "2021-07-23T23:58:14Z",
			"sandbox": [{
				"sha256": "279REDACTED",
				"environment_id": 300
			}]
		}],
		"errors": []
	}
}

[bp4151]

Hi @jshcodes

Thank you for your suggestion. I copied yours verbatim, changed the file to harry_caray.jpg (because I thought Holy Cow! was somehow appropriate) and put in my creds.

Upload returns a 200, Submit returns a 403 with the same token. So confused...

[jshcodes]

Do you have write to the Sandbox API?