DisplyHTMLWIthImages: fix embeded images (#35135)

* potential fix * update RN * Bump pack from version CommonScripts to 1.15.20. * Bump pack from version CommonScripts to 1.15.21. * Bump pack from version CommonScripts to 1.15.22. * Bump pack from version CommonScripts to 1.15.23. * Bump pack from version CommonScripts to 1.15.24. * Bump pack from version CommonScripts to 1.15.25. * fix * pre commit fix * Bump pack from version CommonScripts to 1.15.26. * cr changes * CR changes --------- Co-authored-by: Content Bot <[email protected]>
demisto · Jul 16, 2024 · e748e6b · e748e6b
1 parent 4ccf6eb
commit e748e6b
Show file tree

Hide file tree

Showing 5 changed files with 103 additions and 13 deletions.
diff --git a/Packs/CommonScripts/ReleaseNotes/1_15_26.md b/Packs/CommonScripts/ReleaseNotes/1_15_26.md
@@ -0,0 +1,7 @@
+
+#### Scripts
+
+##### DisplayHTMLWithImages
+
+- Fixed an issue where embedded images not appear in the Email Body section in the Phishing incident layout.
+- Updated the Docker image to: *demisto/python3:3.10.14.99474*.
diff --git a/Packs/CommonScripts/Scripts/DisplayHTMLWithImages/DisplayHTMLWithImages.py b/Packs/CommonScripts/Scripts/DisplayHTMLWithImages/DisplayHTMLWithImages.py
@@ -27,10 +27,11 @@ def create_html_with_images(email_html='', entry_id_list=None):
     return email_html
 
 
-def get_entry_id_list(attachments, files):
-    """Get the email attachments and create entry id list.
+# for backwards compatible
+def get_entry_id_list_by_incident_attachments(attachments, files):
+    """Get the incident attachments and create entry id list.
     Args:
-        attachments (list): The attachments of the email.
+        attachments (list): The incident attachments.
         files (list): The uploaded files in the context.
     Returns:
         list. Attachments entries ids list.
@@ -39,29 +40,51 @@ def get_entry_id_list(attachments, files):
         return []
 
     entry_id_list = []
-    files = [files] if not isinstance(files, list) else files
     for attachment in attachments:
         attachment_name = attachment.get('name', '')
+        if attachment_name and not attachment_name.endswith('eml'):
+            for file in files:
+                if attachment_name == file.get('Name'):
+                    entry_id_list.append((attachment_name, file.get('EntryID')))
+    demisto.info(f'\n\n idlist by incident attachments \n\n{entry_id_list}')
+    return entry_id_list
+
+
+def get_entry_id_list_by_parsed_email_attachments(attachments, files):
+    """Get the email attachments and create entry id list.
+    Args:
+        attachments (list): The parsed email attachments.
+        files (list): The uploaded files in the context.
+    Returns:
+        list. Attachments entries ids list.
+    """
+    if not (attachments and files):
+        return []
+
+    entry_id_list = []
+    for attachment in attachments:
+        attachment_name = attachment.get('Name', '')
         for file in files:
             if attachment_name == file.get('Name'):
                 entry_id_list.append((attachment_name, file.get('EntryID')))
-    demisto.info(f'\n\n idlist \n\n{entry_id_list}')
+    demisto.info(f'\n\n idlist by parsed email attachments\n\n{entry_id_list}')
     return entry_id_list
 
 
 def main(args):
     incident = demisto.incident()
     custom_fields = incident.get('CustomFields', {})
-    html_body = custom_fields.get('renderedhtml', '') or \
-        custom_fields.get('emailhtml', '') or \
+    html_body = custom_fields.get('emailhtml', '') or \
         custom_fields.get('emailbody', '')
-    attachments = incident.get('attachment', {})
     files = demisto.context().get('File', [])
-
+    files = [files] if not isinstance(files, list) else files
     html_body = f'<div style= "background-color: white;"> {html_body} </div>'
-
     if 'src="cid' in html_body:
-        entry_id_list = get_entry_id_list(attachments, files)
+        attachments = incident.get('attachment', {})
+        entry_id_list = get_entry_id_list_by_incident_attachments(attachments, files)
+        if not entry_id_list:
+            attachments = demisto.get(demisto.context(), 'Email.AttachmentsData', [])
+            entry_id_list = get_entry_id_list_by_parsed_email_attachments(attachments, files)
         html_body = create_html_with_images(html_body, entry_id_list)
 
     return_results({

diff --git a/Packs/CommonScripts/Scripts/DisplayHTMLWithImages/DisplayHTMLWithImages.yml b/Packs/CommonScripts/Scripts/DisplayHTMLWithImages/DisplayHTMLWithImages.yml
@@ -11,6 +11,6 @@ tags:
 system: true
 scripttarget: 0
 fromversion: 6.5.0
-dockerimage: demisto/python3:3.10.14.98889
+dockerimage: demisto/python3:3.10.14.99474
 tests:
 - No tests (auto formatted)
diff --git a/Packs/CommonScripts/Scripts/DisplayHTMLWithImages/DisplayHTMLWithImages_test.py b/Packs/CommonScripts/Scripts/DisplayHTMLWithImages/DisplayHTMLWithImages_test.py
@@ -118,3 +118,63 @@ def test_main_mt(mocker, email_html, expected):
     main({})
 
     assert expected in DisplayHTMLWithImages.return_results.call_args[0][0]['Contents']
+
+
+@pytest.mark.parametrize(
+    "email_html,expected",
+    [
+        (EMAIL_HTML, EXPECTED_RESULT_2),
+        (EMAIL_HTML_NO_ALT, EXPECTED_RESULT_NO_ALT)
+    ]
+)
+def test_imgaes_not_attached_to_incident(mocker, email_html, expected):
+    """
+        Given
+        - Html contained images src but not attached to incident.
+        When
+        - All images were uploaded to the server
+        Then
+        - The images' src attribute would be replaced as expected with account tenant name
+    """
+    import DisplayHTMLWithImages
+    from DisplayHTMLWithImages import main
+
+    mocked_incident = {
+        'CustomFields': {
+            'emailbody': email_html
+        },
+        'attachment': [
+
+        ]
+    }
+    mocked_files = [
+        {'Name': 'image_1.png', 'EntryID': '37@119'},
+        {'Name': 'image_2.png', 'EntryID': '38@120'}
+    ]
+
+    mocked_context = {
+        'Email': {
+            'AttachmentsData': [
+                {
+                    'Content-Disposition': 'attachment; filename="image_1.png"',
+                    'Content-ID': '<ii_lyfigebl1>',
+                    'Name': 'image_1.png'
+                },
+                {
+                    'Content-Disposition': 'attachment; filename="image_2.png"',
+                    'Content-ID': '<ii_lyfigebl1>',
+                    'Name': 'image_2.png'
+                }
+            ]
+        },
+        'File': mocked_files
+    }
+
+    mocker.patch.object(demisto, 'demistoUrls', return_value={'server': 'https://localhost:8443:/acc_test_tenant'})
+    mocker.patch.object(demisto, 'incident', return_value=mocked_incident)
+    mocker.patch.object(demisto, 'context', return_value=mocked_context)
+    mocker.patch.object(DisplayHTMLWithImages, 'return_results')
+
+    main({})
+
+    assert expected in DisplayHTMLWithImages.return_results.call_args[0][0]['Contents']
diff --git a/Packs/CommonScripts/pack_metadata.json b/Packs/CommonScripts/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "Common Scripts",
     "description": "Frequently used scripts pack.",
     "support": "xsoar",
-    "currentVersion": "1.15.25",
+    "currentVersion": "1.15.26",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",