Skip to content

[ BUG ] Missing comma in _payload/_generic.py causes implicit string concatenation breaking aggregate kwargs #1460

@alhumaw

Description

@alhumaw

Describe the bug

The aggregate_payload function in _payload/_generic.py has a missing comma between "extended_bounds" and "filters_spec" in a list literal at lines 126-127. Python silently concatenates adjacent string literals, producing "extended_boundsfilters_spec" as a single key instead of two separate keys. This means neither extended_bounds nor filters_spec kwargs work for ANY aggregate operation across the entire SDK (Alerts, Hosts, Detects, RTR, Intel, etc.).

To Reproduce

  1. Create any service class instance that supports aggregate operations
  2. Call an aggregate method passing extended_bounds or filters_spec as kwargs:
from falconpy import Hosts

falcon = Hosts(client_id="ID", client_secret="SECRET")
result = falcon.query_devices_by_filter_scroll(
    date_ranges=[{"from": "2024-01-01", "to": "2024-12-31"}],
    field="hostname",
    extended_bounds={"min": "2024-01-01", "max": "2024-12-31"},
    filters_spec={"filters": "platform_name:'Windows'"}
)
  1. Neither extended_bounds nor filters_spec appear in the request body sent to the API. The kwargs are silently ignored.

The root cause is a missing comma in src/falconpy/_payload/_generic.py lines 126-127:

# Current (broken) - implicit string concatenation
keys = ["date_ranges", "exclude", "extended_bounds"
        "filters_spec", "from", "include", ...]

# This produces: [..., "extended_boundsfilters_spec", "from", ...]

Expected behavior

Passing extended_bounds or filters_spec as keyword arguments should include them in the JSON body sent to the API, consistent with the documented kwargs in all aggregate operation docstrings.

Environment (please complete the following information):

  • OS: All
  • Python: All supported versions
  • FalconPy: --

Additional context

This affects ALL service collections that use aggregate operations (Alerts, CAO Hunting, Case Management, Cloud Security, Container services, Custom IOA, Detects, Discover, Drift Indicators, Event Streams, Exposure Management, FalconX, Firewall, Hosts, Intel, IOCs, Kubernetes, MalQuery, MSSP, ODS, Recon, RTR, Spotlight, Threatgraph, Unidentified Containers, Workflows, and more).

Workaround: pass a pre-built body list to bypass the payload builder:

result = falcon.query_devices_by_filter_scroll(body=[{
    "date_ranges": [{"from": "2024-01-01", "to": "2024-12-31"}],
    "field": "hostname",
    "extended_bounds": {"min": "2024-01-01", "max": "2024-12-31"},
    "filters_spec": {"filters": "platform_name:'Windows'"}
}])

Fix: add the missing comma in src/falconpy/_payload/_generic.py line 126:

# Before
keys = ["date_ranges", "exclude", "extended_bounds"
        "filters_spec", "from", "include", ...]
# After
keys = ["date_ranges", "exclude", "extended_bounds",
        "filters_spec", "from", "include", ...]

Metadata

Metadata

Assignees

Labels

bug 🐛Something isn't working

Type

No fields configured for Bug.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions