cti-python-stix2/stix2/test/v21/test_utils.py

# -*- coding: utf-8 -*-

import datetime as dt
from io import StringIO

import pytest
import pytz

import stix2.utils

from .constants import IDENTITY_ID

amsterdam = pytz.timezone('Europe/Amsterdam')
eastern = pytz.timezone('US/Eastern')


@pytest.mark.parametrize(
    'dttm, timestamp', [
        (dt.datetime(2017, 1, 1, tzinfo=pytz.utc), '2017-01-01T00:00:00Z'),
        (amsterdam.localize(dt.datetime(2017, 1, 1)), '2016-12-31T23:00:00Z'),
        (eastern.localize(dt.datetime(2017, 1, 1, 12, 34, 56)), '2017-01-01T17:34:56Z'),
        (eastern.localize(dt.datetime(2017, 7, 1)), '2017-07-01T04:00:00Z'),
        (dt.datetime(2017, 7, 1), '2017-07-01T00:00:00Z'),
        (dt.datetime(2017, 7, 1, 0, 0, 0, 1), '2017-07-01T00:00:00.000001Z'),
        (stix2.utils.STIXdatetime(2017, 7, 1, 0, 0, 0, 1, precision='millisecond'), '2017-07-01T00:00:00.000Z'),
        (stix2.utils.STIXdatetime(2017, 7, 1, 0, 0, 0, 1, precision='second'), '2017-07-01T00:00:00Z'),
    ],
)
def test_timestamp_formatting(dttm, timestamp):
    assert stix2.utils.format_datetime(dttm) == timestamp


@pytest.mark.parametrize(
    'timestamp, dttm', [
        (dt.datetime(2017, 1, 1, 0, tzinfo=pytz.utc), dt.datetime(2017, 1, 1, 0, 0, 0, tzinfo=pytz.utc)),
        (dt.date(2017, 1, 1), dt.datetime(2017, 1, 1, 0, 0, 0, tzinfo=pytz.utc)),
        ('2017-01-01T00:00:00Z', dt.datetime(2017, 1, 1, 0, 0, 0, tzinfo=pytz.utc)),
        ('2017-01-01T02:00:00+2:00', dt.datetime(2017, 1, 1, 0, 0, 0, tzinfo=pytz.utc)),
        ('2017-01-01T00:00:00', dt.datetime(2017, 1, 1, 0, 0, 0, tzinfo=pytz.utc)),
    ],
)
def test_parse_datetime(timestamp, dttm):
    assert stix2.utils.parse_into_datetime(timestamp) == dttm


@pytest.mark.parametrize(
    'timestamp, dttm, precision', [
        ('2017-01-01T01:02:03.000001', dt.datetime(2017, 1, 1, 1, 2, 3, 0, tzinfo=pytz.utc), 'millisecond'),
        ('2017-01-01T01:02:03.001', dt.datetime(2017, 1, 1, 1, 2, 3, 1000, tzinfo=pytz.utc), 'millisecond'),
        ('2017-01-01T01:02:03.1', dt.datetime(2017, 1, 1, 1, 2, 3, 100000, tzinfo=pytz.utc), 'millisecond'),
        ('2017-01-01T01:02:03.45', dt.datetime(2017, 1, 1, 1, 2, 3, 450000, tzinfo=pytz.utc), 'millisecond'),
        ('2017-01-01T01:02:03.45', dt.datetime(2017, 1, 1, 1, 2, 3, tzinfo=pytz.utc), 'second'),
    ],
)
def test_parse_datetime_precision(timestamp, dttm, precision):
    assert stix2.utils.parse_into_datetime(timestamp, precision) == dttm


@pytest.mark.parametrize(
    'ts', [
        'foobar',
        1,
    ],
)
def test_parse_datetime_invalid(ts):
    with pytest.raises(ValueError):
        stix2.utils.parse_into_datetime('foobar')


@pytest.mark.parametrize(
    'data', [
        {"a": 1},
        '{"a": 1}',
        StringIO(u'{"a": 1}'),
        [("a", 1,)],
    ],
)
def test_get_dict(data):
    assert stix2.utils._get_dict(data)


@pytest.mark.parametrize(
    'data', [
        1,
        [1],
        ['a', 1],
        "foobar",
    ],
)
def test_get_dict_invalid(data):
    with pytest.raises(ValueError):
        stix2.utils._get_dict(data)


@pytest.mark.parametrize(
    'stix_id, type', [
        ('malware--d69c8146-ab35-4d50-8382-6fc80e641d43', 'malware'),
        ('intrusion-set--899ce53f-13a0-479b-a0e4-67d46e241542', 'intrusion-set'),
    ],
)
def test_get_type_from_id(stix_id, type):
    assert stix2.utils.get_type_from_id(stix_id) == type


def test_deduplicate(stix_objs1):
    unique = stix2.utils.deduplicate(stix_objs1)

    # Only 3 objects are unique
    # 2 id's vary
    # 2 modified times vary for a particular id

    assert len(unique) == 3

    ids = [obj['id'] for obj in unique]
    mods = [obj['modified'] for obj in unique]

    assert "indicator--00000000-0000-4000-8000-000000000001" in ids
    assert "indicator--00000000-0000-4000-8000-000000000001" in ids
    assert "2017-01-27T13:49:53.935Z" in mods
    assert "2017-01-27T13:49:53.936Z" in mods


@pytest.mark.parametrize(
    'object, tuple_to_find, expected_index', [
        (
            stix2.v21.ObservedData(
                id="observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf",
                created_by_ref=IDENTITY_ID,
                created="2016-04-06T19:58:16.000Z",
                modified="2016-04-06T19:58:16.000Z",
                first_observed="2015-12-21T19:00:00Z",
                last_observed="2015-12-21T19:00:00Z",
                number_observed=50,
                objects={
                    "0": {
                        "name": "foo.exe",
                        "type": "file",
                        "id": "file--5956efbb-a7b0-566d-a7f9-a202eb05c70f",
                    },
                    "1": {
                        "type": "ipv4-addr",
                        "value": "198.51.100.3",
                        "id": "ipv4-addr--1f8f4d63-9f33-5353-a3e3-e1b84c83a7b5",
                    },
                    "2": {
                        "type": "network-traffic",
                        "src_ref": "ipv4-addr--1f8f4d63-9f33-5353-a3e3-e1b84c83a7b5",
                        "protocols": [
                          "tcp",
                          "http",
                        ],
                        "extensions": {
                            "http-request-ext": {
                                "request_method": "get",
                                "request_value": "/download.html",
                                "request_version": "http/1.1",
                                "request_header": {
                                    "Accept-Encoding": "gzip,deflate",
                                    "User-Agent": "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113",
                                    "Host": "www.example.com",
                                },
                            },
                        },
                    },
                },
            ), ('1', {"type": "ipv4-addr", "value": "198.51.100.3", "id": "ipv4-addr--1f8f4d63-9f33-5353-a3e3-e1b84c83a7b5"}), 1,
        ),
        (
            {
                "type": "x-example",
                "id": "x-example--d5413db2-c26c-42e0-b0e0-ec800a310bfb",
                "created": "2018-06-11T01:25:22.063Z",
                "modified": "2018-06-11T01:25:22.063Z",
                "dictionary": {
                    "key": {
                        "key_one": "value",
                        "key_two": "value",
                    },
                },
            }, ('key', {'key_one': 'value', 'key_two': 'value'}), 0,
        ),
        (
            {
                "type": "language-content",
                "spec_version": "2.1",
                "id": "language-content--b86bd89f-98bb-4fa9-8cb2-9ad421da981d",
                "created": "2017-02-08T21:31:22.007Z",
                "modified": "2017-02-08T21:31:22.007Z",
                "object_ref": "campaign--12a111f0-b824-4baf-a224-83b80237a094",
                "object_modified": "2017-02-08T21:31:22.007Z",
                "contents": {
                    "de": {
                        "name": "Bank Angriff 1",
                        "description": "Weitere Informationen über Banküberfall",
                    },
                    "fr": {
                        "name": "Attaque Bank 1",
                        "description": "Plus d'informations sur la crise bancaire",
                    },
                },
            }, ('fr', {"name": "Attaque Bank 1", "description": "Plus d'informations sur la crise bancaire"}), 1,
        ),
    ],
)
def test_find_property_index(object, tuple_to_find, expected_index):
    assert stix2.utils.find_property_index(
        object,
        *tuple_to_find
    ) == expected_index


@pytest.mark.parametrize(
    'dict_value, tuple_to_find, expected_index', [
        (
            {
                "contents": {
                    "de": {
                        "name": "Bank Angriff 1",
                        "description": "Weitere Informationen über Banküberfall",
                    },
                    "fr": {
                        "name": "Attaque Bank 1",
                        "description": "Plus d'informations sur la crise bancaire",
                    },
                    "es": {
                        "name": "Ataque al Banco",
                        "description": "Mas informacion sobre el ataque al banco",
                    },
                },
            }, ('es', {"name": "Ataque al Banco", "description": "Mas informacion sobre el ataque al banco"}), 1,
        ),  # Sorted alphabetically
        (
            {
                'my_list': [
                    {"key_one": 1},
                    {"key_two": 2},
                ],
            }, ('key_one', 1), 0,
        ),
    ],
)
def test_iterate_over_values(dict_value, tuple_to_find, expected_index):
    assert stix2.utils._find_property_in_seq(dict_value.values(), *tuple_to_find) == expected_index