fix(graph): reject unknown graph names in /graph/search with a 400 (#1290)

Author: tomchop

core/database_arango.py

@@ -32,10 +32,9 @@
 CODE_DB_VERSION = 2
 AQL_QUERY_MAX_TTL = 3600 * 12
 
-LINK_TYPE_TO_GRAPH = {
-    "tagged": "tags",
-    "stix": "stix",
-}
+# Edge collections that back the defined ArangoDB graphs (see create_graphs);
+# these are the only names neighbors() can traverse with `@@graph`.
+TRAVERSABLE_GRAPHS = {"links", "acls"}
 
 TESTING = "unittest" in sys.modules.keys()
 
@@ -862,6 +861,11 @@ def neighbors(
             - the relationships (edges),
             - total neighbor (vertices) count
         """
+        if graph not in TRAVERSABLE_GRAPHS:
+            raise ValueError(
+                f"Cannot traverse graph '{graph}': expected one of "
+                f"{sorted(TRAVERSABLE_GRAPHS)}."
+            )
         query_filter = ""
         args = {
             "extended_id": self.extended_id,

core/web/apiv2/graph.py

@@ -142,20 +142,23 @@ def search(httpreq: Request, request: GraphSearchRequest) -> GraphSearchResponse
         raise HTTPException(
             status_code=404, detail=f"Source object {request.source} not found"
         )
-    vertices, paths, total = yeti_object.neighbors(
-        link_types=request.link_types,
-        target_types=request.target_types,
-        direction=request.direction,
-        filter=request.filter,
-        include_original=request.include_original,
-        graph=request.graph,
-        min_hops=request.min_hops or request.hops,
-        max_hops=request.max_hops or request.hops,
-        count=request.count,
-        offset=request.page * request.count,
-        sorting=request.sorting,
-        user=httpreq.state.user,
-    )
+    try:
+        vertices, paths, total = yeti_object.neighbors(
+            link_types=request.link_types,
+            target_types=request.target_types,
+            direction=request.direction,
+            filter=request.filter,
+            include_original=request.include_original,
+            graph=request.graph,
+            min_hops=request.min_hops or request.hops,
+            max_hops=request.max_hops or request.hops,
+            count=request.count,
+            offset=request.page * request.count,
+            sorting=request.sorting,
+            user=httpreq.state.user,
+        )
+    except ValueError as error:
+        raise HTTPException(status_code=400, detail=str(error))
     return GraphSearchResponse(vertices=vertices, paths=paths, total=total)
 
 

tests/apiv2/graph.py

@@ -68,6 +68,23 @@ def test_get_neighbors(self):
         self.assertEqual(edges[0][0]["target"], self.observable2.extended_id)
         self.assertEqual(edges[0][0]["type"], "resolves")
 
+    def test_get_neighbors_unknown_graph(self):
+        # An unknown graph name (e.g. the retired "tagged" graph) has no edge
+        # collection to traverse; the API must reject it cleanly, not 500.
+        response = client.post(
+            "/api/v2/graph/search",
+            json={
+                "source": self.observable1.extended_id,
+                "hops": 1,
+                "graph": "tagged",
+                "direction": "any",
+                "include_original": False,
+            },
+        )
+        data = response.json()
+        self.assertEqual(response.status_code, 400, data)
+        self.assertIn("Cannot traverse graph 'tagged'", data["detail"])
+
     def test_get_neighbors_bad_hops(self):
         response = client.post(
             "/api/v2/graph/search",