[ilappe]

Summary

• Bug: in SplunkPy v2, adding a note through splunk-finding-event-edit, splunk-update-investigation, or outgoing mirroring failed with HTTP 400 Unparsable URI-encoded request data whenever the note contained a bare % (for example 0%.). The integration sent JSON bodies without a Content-Type, so splunklib used its default application/x-www-form-urlencoded, and splunkd rejected the body as invalid URI-encoded data.
• Fix: a new _post_json() helper sends Content-Type: application/json. In the splunklib version shipped in the image, the form header is added only when no Content-Type is set. All JSON POSTs to the Mission Control v2 API now use the helper: notes, investigation/finding updates, _es_rest_request, and add findings.
• Tests: new wire-level tests run through a real splunklib Service, using notes with %, +, & and %20. They check the headers and the raw body, and they fail on the old code. Another test covers the path through requests_handler, and the existing assertions are updated.
• QA (XSOAR SaaS tenant + dev Splunk ES 8):
  • On the original code, the bug reproduced: HTTP 400 on both a finding note and an investigation note.
  • On the fixed code, Splunk returns 201 and stores the note text exactly as sent.
• Release notes: pack 4.3.8.

Related Issues

fixes: XSUP-80754

[content-bot]

🤖 AI-Powered Code Review Available

You can leverage AI-powered code review to assist with this PR!

Available Commands:

• @marketplace-ai-reviewer start review - Initiate a full AI code review
• @marketplace-ai-reviewer re-review - Incremental review for new commits

[github-actions]

Coverage Report

File	Stmts	Miss	Cover	Missing
Packs/SplunkPy/Integrations/SplunkPyV2
SplunkPyV2.py	2407	435	81%	185, 188, 270, 296–297, 299–304, 306, 367–369, 423, 434, 576, 599, 610, 993, 999, 1002, 1133–1134, 1138, 1215, 1220, 1293–1294, 1322, 1336, 1346, 1349–1350, 1379–1380, 1433, 1552–1554, 1605, 1684, 1708–1709, 1791–1792, 1807–1812, 1838–1839, 1921–1926, 1928, 1932–1933, 2039, 2231–2232, 2314–2316, 2333–2334, 2369–2378, 2413–2414, 2416, 2434, 2481–2483, 2488–2489, 2495, 2498–2499, 2530–2531, 2539, 2597–2600, 2606–2608, 2612, 2669–2670, 2674–2676, 2678–2679, 2747, 2749, 2752–2755, 2758–2759, 2761–2763, 2780, 2786, 2825–2826, 2829–2830, 2833–2835, 2839, 2848, 2853, 2855–2856, 2861, 2863–2868, 2870–2871, 2876–2878, 2881–2885, 2890–2892, 2896–2898, 2901–2904, 2907–2909, 2913, 2919, 2921, 2924–2925, 2927–2928, 2930, 2933, 2963, 3001–3003, 3018–3019, 3036, 3078, 3080–3082, 3185, 3231, 3261, 3291, 3294–3295, 3300, 3323, 3507–3508, 3537–3538, 3541, 3543, 3551, 3553–3556, 3558–3566, 3568–3569, 4097, 4170, 4233, 4235, 4237, 4307, 4311–4313, 4317, 4320, 4322, 4367–4371, 4585, 4624, 4628, 4648, 4651, 4661, 4663–4664, 4713, 4735, 4776, 4782, 4793, 4801, 4806, 4830–4831, 4870, 4881–4883, 4886–4887, 4889, 4904, 4929–4937, 4939, 4941–4944, 4946–4947, 4953, 4968, 4999–5002, 5005–5008, 5021–5024, 5068, 5109, 5150, 5179, 5181, 5186, 5205, 5209, 5240, 5276, 5289–5292, 5296–5297, 5301, 5315–5316, 5326, 5330, 5354–5356, 5362–5365, 5367, 5376, 5378, 5468–5470, 5501, 5503, 5511, 5513–5514, 5530–5531, 5534–5536, 5580–5581, 5586–5587, 5603–5607, 5610, 5612, 5618–5625, 5627–5628, 5630–5631, 5635–5643, 5645–5648, 5812–5813, 5816–5818, 5820, 5826–5834, 5839, 5845–5848, 5854–5857, 5861–5864, 5879, 5881–5882, 5884–5886, 5895, 5899–5906, 5913, 5930–5935, 5954–5961, 5965–5966, 5968–5973
TOTAL	2407	435	81%

Tests	Skipped	Failures	Errors	Time
459	0 💤	0 ❌	0 🔥	4.335s ⏱️

[marketplace-ai-reviewer]

🤖 Analysis started. Please wait for results...

[marketplace-ai-reviewer]

🤖 AI Review Disclaimer

This review was generated by an AI-powered tool and may contain inaccuracies. Please be advised, and we extend our sincere apologies for any inconvenience this may cause.

[marketplace-ai-reviewer]

Thank you for your contribution! No issues found. Great work! 👍

@kamalq97, @DeanArbel, @ilappe please review and approve the results generated by the AI Reviewer by responding 👍 on this comment.