Base64ListToFile

Details

ID	`Base64ListToFile`
Language	python
From Version	5.0.0
Docker Image	`demisto/python3:3.12.13.10404775`
Tags	list Utility

README

Converts Base64 file in a list to a binary file and upload to warroom

Script Data

Name	Description
Script Type	python3
Tags	list, Utility
Cortex XSOAR Version	5.0.0

Inputs

Argument Name	Description
listname	List Name of Base64 item (need to be a single file in list)
filename	Optional Warroom Output Filename (default filename is list name)
isZipFile	Is data compressed (zip format)?

Outputs

Path	Description	Type
File.Name	Filename (only in case of report type=json)	Unknown
File.Type	File type e.g. “PE” (only in case of report type=json)	Unknown
File.Size	File size (only in case of report type=json)	Unknown
File.MD5	MD5 hash of the file (only in case of report type=json)	Unknown
File.SHA1	SHA1 hash of the file (only in case of report type=json)	Unknown
File.SHA256	SHA256 hash of the file (only in case of report type=json)	Unknown
File.EntryID	EntryID of the file (only in case of report type=json)	Unknown

Script Examples

Example command

!Base64ListToFile listname="test_list_name" filename="test_file_name.txt" isZipFile="no"

Context Example

{
    "File": {
        "EntryID": "192@2ae905f4-bec0-43aa-8af3-99fb982d719f",
        "Extension": "txt",
        "Info": "text/plain; charset=utf-8",
        "MD5": "4d8d433345a1a5d3b0ba3157e7d6b411",
        "Name": "test_file_name.txt",
        "SHA1": "e4e62ac169793ebecc9e45eb14906a6a8c04a399",
        "SHA256": "0d732beba373d960e4dc305b6862309ae996748e21b1417e0bb9f0dfe9aab08e",
        "SHA512": "47d276725420776ac107319135a8b61aeff605397e9486ff4642d2b0b804376e781505ad3a41a8f084ac220495201502dbae2d736a7d9cd3a59301c3d650c1c6",
        "SSDeep": "3:YKE4Lr/CLXxMt:Yf4veKt",
        "Size": 40,
        "Type": "ASCII text"
    }
}

Source

Base64ListToFile.py Base64ListToFile_test.py Base64ListToFile.yml command_examples.txt

Download History Raw

import base64
import zlib

import demistomock as demisto  # noqa: F401
from CommonServerPython import *  # noqa: F401


def test_valid_base64_file_in_list(mocker, tmp_path):
    import Base64ListToFile

    encoded = base64.b64encode(bytes("hello world!", "utf-8")).decode("utf-8")

    mocker.patch.object(demisto, "executeCommand", return_value=[{"Type": EntryType.NOTE, "Contents": encoded}])
    args = {"listname": "test_list"}
    res = Base64ListToFile.base64_list_to_file(args)

    create_file_name = "1_" + res["FileID"]
    with open(create_file_name, mode="rb") as f:
        assert f.read() == bytes("hello world!", "utf-8")

    assert res["File"] == args["listname"]


def test_valid_base64_file_in_list_zip(mocker):
    import Base64ListToFile

    encoded = base64.b64encode(zlib.compress(bytes("hello world!", "utf-8"))).decode("utf-8")

    mocker.patch.object(demisto, "executeCommand", return_value=[{"Type": EntryType.NOTE, "Contents": encoded}])

    args = {"filename": "test_filename", "listname": "test_list", "isZipFile": "yes"}
    res = Base64ListToFile.base64_list_to_file(args)

    create_file_name = "1_" + res["FileID"]

    with open(create_file_name, mode="rb") as f:
        assert f.read() == bytes("hello world!", "utf-8")

    assert res["File"] == args["filename"]


def test_invalid_base64_file_in_list(mocker):
    import Base64ListToFile

    mocker.patch.object(demisto, "executeCommand", return_value=[{"Type": EntryType.NOTE, "Contents": "INVALID_BASE64_STRING"}])

    args = {
        "listname": "test_list",
    }

    try:
        Base64ListToFile.base64_list_to_file(args)
        assert False  # noqa: PT015, B011
    except Exception:
        assert True