From 4a95a54501cd12c487a559ff9bcf9d1de7e1de80 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= <raphael@vinot.info>
Date: Fri, 5 Jan 2018 11:34:08 +0100
Subject: [PATCH] fix: disable_correlation from template not properly used

---
 pymisp/mispevent.py                      |  2 +-
 tests/mispevent_testfiles/def_param.json | 55 ++++++++++++++++++++++++
 tests/test_mispevent.py                  | 12 ++++++
 3 files changed, 68 insertions(+), 1 deletion(-)
 create mode 100644 tests/mispevent_testfiles/def_param.json

diff --git a/pymisp/mispevent.py b/pymisp/mispevent.py
index cb236bf..53a36bd 100644
--- a/pymisp/mispevent.py
+++ b/pymisp/mispevent.py
@@ -851,7 +851,7 @@ class MISPObjectAttribute(MISPAttribute):
         self.type = kwargs.pop('type', None)
         if self.type is None:
             self.type = self.__definition.get('misp-attribute')
-        self.disable_correlation = kwargs.pop('disable_correlation', False)
+        self.disable_correlation = kwargs.pop('disable_correlation', None)
         if self.disable_correlation is None:
             # The correlation can be disabled by default in the object definition.
             # Use this value if it isn't overloaded by the object
diff --git a/tests/mispevent_testfiles/def_param.json b/tests/mispevent_testfiles/def_param.json
new file mode 100644
index 0000000..49a22b3
--- /dev/null
+++ b/tests/mispevent_testfiles/def_param.json
@@ -0,0 +1,55 @@
+{
+  "Event": {
+    "Object": [
+      {
+        "Attribute": [
+          {
+            "category": "Attribution",
+            "disable_correlation": false,
+            "object_relation": "registrar",
+            "to_ids": false,
+            "type": "whois-registrar",
+            "value": "registar.example.com"
+          },
+          {
+            "category": "Network activity",
+            "disable_correlation": false,
+            "object_relation": "domain",
+            "to_ids": true,
+            "type": "domain",
+            "value": "domain.example.com"
+          },
+          {
+            "category": "Network activity",
+            "disable_correlation": true,
+            "object_relation": "nameserver",
+            "to_ids": false,
+            "type": "hostname",
+            "value": "ns1.example.com"
+          },
+          {
+            "category": "External analysis",
+            "disable_correlation": false,
+            "object_relation": "nameserver",
+            "to_ids": true,
+            "type": "hostname",
+            "value": "ns2.example.com"
+          }
+        ],
+        "description": "Whois records information for a domain name.",
+        "distribution": 5,
+        "meta-category": "network",
+        "name": "whois",
+        "sharing_group_id": 0,
+        "template_uuid": "429faea1-34ff-47af-8a00-7c62d3be5a6a",
+        "template_version": 7,
+        "uuid": "a"
+      }
+    ],
+    "analysis": "1",
+    "date": "2017-12-31",
+    "distribution": "1",
+    "info": "This is a test",
+    "threat_level_id": "1"
+  }
+}
diff --git a/tests/test_mispevent.py b/tests/test_mispevent.py
index 2cbeebf..919c2cf 100644
--- a/tests/test_mispevent.py
+++ b/tests/test_mispevent.py
@@ -140,6 +140,18 @@ class TestMISPEvent(unittest.TestCase):
             ref_json = json.load(f)
         self.assertEqual(self.mispevent.to_json(), json.dumps(ref_json, sort_keys=True, indent=2))
 
+    def test_obj_default_values(self):
+        self.init_event()
+        self.mispevent.add_object(name='whois', strict=True)
+        self.mispevent.objects[0].add_attribute('registrar', value='registar.example.com')
+        self.mispevent.objects[0].add_attribute('domain', value='domain.example.com')
+        self.mispevent.objects[0].add_attribute('nameserver', value='ns1.example.com')
+        self.mispevent.objects[0].add_attribute('nameserver', value='ns2.example.com', disable_correlation=False, to_ids=True, category='External analysis')
+        self.mispevent.objects[0].uuid = 'a'
+        with open('tests/mispevent_testfiles/def_param.json', 'r') as f:
+            ref_json = json.load(f)
+        self.assertEqual(self.mispevent.to_json(), json.dumps(ref_json, sort_keys=True, indent=2))
+
 
 if __name__ == '__main__':
     unittest.main()