Skip to content

Bug fix #181 and #182 #183

Merged
pagbabian-splunk merged 5 commits into
ocsf:mainfrom
floydtree:bug_fix_#182
Jun 17, 2026
Merged

Bug fix #181 and #182 #183
pagbabian-splunk merged 5 commits into
ocsf:mainfrom
floydtree:bug_fix_#182

Conversation

@floydtree

Copy link
Copy Markdown
Contributor

Summary

Details

Profile filtering crash (#182)

filter_attributes_by_profiles_set/2 in utils.ex used Enum.filter/2 on a map of attributes. In Elixir, Enum.filter on a map returns a list of {key, value} tuples — not a map. When passed to Jason.encode!/2, it raised Protocol.UndefinedError because Jason cannot encode tuples.

Added a when is_map(attributes) clause that uses Map.filter/2 to preserve the map structure.

Source attribute rendering (#181)

The source meta schema attribute was rendered as a bold <dt> definition term on its own line, while references rendered as a subdued inline element. Since source indicates the original field name in the standard referenced by references, it now renders inline after the reference tags:

Refs: RFC 5322 (as Message-ID)

Changed inline_references/1 to accept an optional source parameter and append it as (as <code>source</code>) in a muted style consistent with the refs label.

Test plan

  • GET /api/classes/account_change?profiles=host → 200 with filtered attributes
  • GET /api/classes/account_change?profiles=%22host%22 → 200
  • GET /api/classes/account_change?profiles=%5B%22host%22%5D → 200
  • GET /api/classes/file_activity?profiles=cloud → 200
  • GET /api/classes/account_change (no profile) → 200, unchanged behavior
  • All 12 source occurrences render inline with refs (verified: detection_finding.impact_id, email.message_uid, network_connection_info.community_uid, process_entity.cpid)
  • Pages without source render refs unchanged
  • mix compile passes cleanly

floydtree and others added 5 commits June 16, 2026 16:45
`filter_attributes_by_profiles_set/2` used `Enum.filter/2` on a map,
which returns a list of tuples. Jason cannot encode tuples, causing a
500 error on `/api/classes/:id?profiles=...`. Use `Map.filter/2` when
attributes is a map to preserve the map structure.
Signed-off-by: Rajas Panat <rajaspa@amazon.com>
…he server

Signed-off-by: Rajas Panat <rajaspa@amazon.com>
Signed-off-by: Rajas Panat <rajaspa@amazon.com>
@pagbabian-splunk pagbabian-splunk merged commit e1455ec into ocsf:main Jun 17, 2026
1 check passed
@floydtree floydtree deleted the bug_fix_#182 branch June 17, 2026 18:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

3 participants