Domain observable with underscore is incorrectly rejected

[samczsun]

Description

This regex does not accept underscores in domains, but underscores are permitted in domains.

opencti/opencti-platform/opencti-graphql/src/utils/syntax.js

Line 138 in 542b5cd

export const domainChecker = /^(|([\p{L}\d]|[\p{L}\d][\p{L}\d\p{Pd}]*[\p{L}\d])\.)*([\p{L}\d]|[\p{L}\d][\p{L}\d\p{Pd}]*[\p{L}\d])$/u;

Environment

1. OS (where OpenCTI server runs): Ubuntu
2. OpenCTI version: 6.1.11
3. OpenCTI client: Frontend
4. Other environment details:

Reproducible Steps

Steps to create the smallest reproducible scenario:

1. Create domain observable with domain that contains an underscore, such as example_domain.godaddysites.com

Expected Output

An observable is created

Actual Output

An error occurs

Additional information

Screenshots (optional)

[Jipegien]

RFCs forbid use of underscore in domain names BUT some registrars allow it in subdomains.
We need to modify the regexp to accept underscores in subdomains, but not the domain itself and the TLD

[romain-filigran]

I reopened this issue as I get some ingestion error when trying to create domain observable with value: "test._mysubdomain.mydomain.com"

[SarahBocognano]

@romain-filigran It's because you put the dot before the underscore. Do we want it possible ? If yes I can of course modify the regex to accept a dot followed by an underscore

[aHenryJard]

Reopening: This feature has been reverted du to performance issues, we need to add a test coverage on regeprx performance issue.