[Bug] Fortiguard parser error

[ebdavison]

Describe the bug
Trying to run Fortiguard URL Categorizer and get the following error:

Traceback (most recent call last):
  File "/worker/Fortiguard/urlcategory.py", line 53, in <module>
    URLCategoryAnalyzer().run()
  File "/worker/Fortiguard/urlcategory.py", line 44, in run
    'category': category_match.group(1)
                ^^^^^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'group'

To Reproduce
Steps to reproduce the behavior:

1. enable FortiGuard_URL_Category
2. analyze URL

Expected behavior
A category is returned from the analyzer.

Complementary information
If applicable, add screenshots and any additional information that might help explain your problem.

Work environment

• Client OS: fedora linux
• Server OS: fedora linux / docker install
• Browse type and version: Firefox 118.0.1 (64-bit)
• Cortex version: 3.1.7-1
• Cortex Analyzer/Responder name: Fortiguard URL Category
• Cortex Analyzer/Responder version: 2.1

Possible solutions
If applicable, indicate possible solutions to the problem.

Additional context
Add any other context about the problem here.

[scove]

Think I see the issue here. Are you able to adjust the input and run it successfully on different URLs by any chance?

[ebdavison]

I think I can try a different URL. What is needed?

[ghalib-bello]

I delved further into the source of the error, and it seems to be because requests are being blocked by fortiguard, as a result the request output is <Response [403]>. Since the subsequent line in the code (category_match = re.search(pattern, req.text, flags=0)) erroneously assumes the request was successful (and not <Response [403]>), category_match ends up being None - hence the observed AttributeError above

[nusantara-self]

Hello,

This specific issue is fixed by #1154. However, the analyzer is still rendered useless like mentioned in issue #1192. This is due to an Google reCaptcha implementation on fortiguard side, specifically to not allow programmatically-made calls.

Closing this specific issue as a result.