Update description to make it obvious that filters use ANY logic instead of applying cumulatively (AND logic)

[Aevyz]

Hey, I was continuing to test out some features and I stumbled across something that I found a bit counter-intuitive. When you apply filters they are applied using an ANY logic (any([filename_filter, file_extension_filter, file_signature_filter])). Intuitively I would have expected the filters to apply on top of each other (i.e. the security.evtx file), instead I get all files that have the word security and all evtx files.

Don't get me wrong, I think this behavior makes sense, but it would be nice to have this noted somewhere, since it confused me why I had so many files passed to my next worker.

[hacktobeer]

Good point. This should be documented better. We create common_lib API documentation as you can find here.

Ideally the filter functionallity should be documented in these 2 locations:

• get_input_file() - https://github.com/openrelik/openrelik-worker-common/blob/fe0f461e4738db57186bf83dc9b4a3b2a82806ba/openrelik_worker_common/task_utils.py#L34
• filter_compatible_files() - https://github.com/openrelik/openrelik-worker-common/blob/fe0f461e4738db57186bf83dc9b4a3b2a82806ba/openrelik_worker_common/task_utils.py#L176

Does that make sense? Do you want to make a PR rewording/adding to the method documentation?

[Aevyz]

Sorry took a week off from dev work and forgot to answer. My main concern would be that it is not clear from the UI itself. Like it would be nice to have a notice like this

I took a look around and it does not seem to be that OpenRelik supports this currently, at least there is no obvious field in the Task Metadata
https://github.com/openrelik/openrelik-worker-extraction/blob/main/src/archives.py#L28-L47

and the UI does not have a reference to some form of detailed description, additional information or something like that (https://github.com/openrelik/openrelik-ui/blob/main/src/components/WorkflowTreeNode.vue).

Also correct me if I am wrong, but is the filter behaviour not specified in https://github.com/openrelik/openrelik-worker-extraction/blob/main/src/image_export.py#L159-L161 and not in the commons? Like the filters work as intended (to the best of my knowledge), it is just the "aggregation" that needs to be documented

[hacktobeer]

You could add the description in the below location? The UI displays the task parameters description as defined in the task code itself.

https://github.com/openrelik/openrelik-worker-extraction/blob/main/src/image_export.py#L78

[Aevyz]

Hmmmm, yes that would be a possibility. I was thinking of having a separate field, since it would allow for a better separation of the descriptions (i.e. the note that all filters are applied via OR logic is not relevant to the first filter, but instead to all. Hence, it should have its own field), but I do understand that this is not possible code wise at the moment.

I'll try to think of a good way of describing the filter logic and make a PR