2017-06-12 22:15:12 +02:00
|
|
|
import pytest
|
|
|
|
|
|
|
|
import stix2
|
2019-08-26 23:10:54 +02:00
|
|
|
import stix2.v20
|
2017-06-12 22:15:12 +02:00
|
|
|
|
Improved the exception class hierarchy:
- Removed all plain python base classes (e.g. ValueError, TypeError)
- Renamed InvalidPropertyConfigurationError -> PropertyPresenceError,
since incorrect values could be considered a property config error, and
I really just wanted this class to apply to presence (co-)constraint
violations.
- Added ObjectConfigurationError as a superclass of InvalidValueError,
PropertyPresenceError, and any other exception that could be raised
during _STIXBase object init, which is when the spec compliance
checks happen. This class is intended to represent general spec
violations.
- Did some class reordering in exceptions.py, so all the
ObjectConfigurationError subclasses were together.
Changed how property "cleaning" errors were handled:
- Previous docs said they should all be ValueErrors, but that would require
extra exception check-and-replace complexity in the property
implementations, so that requirement is removed. Doc is changed to just
say that cleaning problems should cause exceptions to be raised.
_STIXBase._check_property() now handles most exception types, not just
ValueError.
- Decided to try chaining the original clean error to the InvalidValueError,
in case the extra diagnostics would be helpful in the future. This is
done via 'six' adapter function and only works on python3.
- A small amount of testing was removed, since it was looking at custom
exception properties which became unavailable once the exception was
replaced with InvalidValueError.
Did another pass through unit tests to fix breakage caused by the changed
exception class hierarchy.
Removed unnecessary observable extension handling code from
parse_observable(), since it was all duplicated in ExtensionsProperty.
The redundant code in parse_observable() had different exception behavior
than ExtensionsProperty, which makes the API inconsistent and unit tests
more complicated. (Problems in ExtensionsProperty get replaced with
InvalidValueError, but extensions problems handled directly in
parse_observable() don't get the same replacement, and so the exception
type is different.)
Redid the workbench monkeypatching. The old way was impossible to make
work, and had caused ugly ripple effect hackage in other parts of the
codebase. Now, it replaces the global object maps with factory functions
which behave the same way when called, as real classes. Had to fix up a
few unit tests to get them all passing with this monkeypatching in place.
Also remove all the xfail markings in the workbench test suite, since all
tests now pass.
Since workbench monkeypatching isn't currently affecting any unit tests,
tox.ini was simplified to remove the special-casing for running the
workbench tests.
Removed the v20 workbench test suite, since the workbench currently only
works with the latest stix object version.
2019-07-19 20:50:11 +02:00
|
|
|
from ...exceptions import InvalidValueError
|
2019-01-29 16:52:59 +01:00
|
|
|
from .constants import FAKE_TIME, IDENTITY_ID, MARKING_DEFINITION_ID
|
2017-07-14 21:30:19 +02:00
|
|
|
|
2018-07-05 21:23:25 +02:00
|
|
|
IDENTITY_CUSTOM_PROP = stix2.v20.Identity(
|
2018-03-02 17:32:07 +01:00
|
|
|
name="John Smith",
|
|
|
|
identity_class="individual",
|
|
|
|
x_foo="bar",
|
|
|
|
allow_custom=True,
|
|
|
|
)
|
2017-07-14 21:30:19 +02:00
|
|
|
|
2017-06-12 22:15:12 +02:00
|
|
|
|
|
|
|
def test_identity_custom_property():
|
2017-08-24 21:46:36 +02:00
|
|
|
with pytest.raises(ValueError) as excinfo:
|
2018-07-05 21:23:25 +02:00
|
|
|
stix2.v20.Identity(
|
2019-01-29 16:52:59 +01:00
|
|
|
id=IDENTITY_ID,
|
2017-06-12 22:15:12 +02:00
|
|
|
created="2015-12-21T19:59:11Z",
|
|
|
|
modified="2015-12-21T19:59:11Z",
|
|
|
|
name="John Smith",
|
|
|
|
identity_class="individual",
|
|
|
|
custom_properties="foobar",
|
|
|
|
)
|
2017-08-24 21:46:36 +02:00
|
|
|
assert str(excinfo.value) == "'custom_properties' must be a dictionary"
|
2017-06-12 22:15:12 +02:00
|
|
|
|
2018-05-17 15:04:44 +02:00
|
|
|
with pytest.raises(stix2.exceptions.ExtraPropertiesError) as excinfo:
|
2018-07-05 21:23:25 +02:00
|
|
|
stix2.v20.Identity(
|
2019-01-29 16:52:59 +01:00
|
|
|
id=IDENTITY_ID,
|
2018-05-17 15:04:44 +02:00
|
|
|
created="2015-12-21T19:59:11Z",
|
|
|
|
modified="2015-12-21T19:59:11Z",
|
|
|
|
name="John Smith",
|
|
|
|
identity_class="individual",
|
|
|
|
custom_properties={
|
|
|
|
"foo": "bar",
|
|
|
|
},
|
|
|
|
foo="bar",
|
2018-07-11 15:41:42 +02:00
|
|
|
)
|
2018-05-17 15:04:44 +02:00
|
|
|
assert "Unexpected properties for Identity" in str(excinfo.value)
|
|
|
|
|
2018-07-05 21:23:25 +02:00
|
|
|
identity = stix2.v20.Identity(
|
2019-01-29 16:52:59 +01:00
|
|
|
id=IDENTITY_ID,
|
2017-06-12 22:15:12 +02:00
|
|
|
created="2015-12-21T19:59:11Z",
|
|
|
|
modified="2015-12-21T19:59:11Z",
|
|
|
|
name="John Smith",
|
|
|
|
identity_class="individual",
|
|
|
|
custom_properties={
|
|
|
|
"foo": "bar",
|
|
|
|
},
|
|
|
|
)
|
|
|
|
assert identity.foo == "bar"
|
|
|
|
|
|
|
|
|
|
|
|
def test_identity_custom_property_invalid():
|
2017-08-24 21:46:36 +02:00
|
|
|
with pytest.raises(stix2.exceptions.ExtraPropertiesError) as excinfo:
|
2018-07-05 21:23:25 +02:00
|
|
|
stix2.v20.Identity(
|
2019-01-29 16:52:59 +01:00
|
|
|
id=IDENTITY_ID,
|
2017-06-12 22:15:12 +02:00
|
|
|
created="2015-12-21T19:59:11Z",
|
|
|
|
modified="2015-12-21T19:59:11Z",
|
|
|
|
name="John Smith",
|
|
|
|
identity_class="individual",
|
|
|
|
x_foo="bar",
|
|
|
|
)
|
2018-07-05 21:23:25 +02:00
|
|
|
assert excinfo.value.cls == stix2.v20.Identity
|
2017-08-24 21:46:36 +02:00
|
|
|
assert excinfo.value.properties == ['x_foo']
|
|
|
|
assert "Unexpected properties for" in str(excinfo.value)
|
2017-06-12 22:15:12 +02:00
|
|
|
|
|
|
|
|
|
|
|
def test_identity_custom_property_allowed():
|
2018-07-05 21:23:25 +02:00
|
|
|
identity = stix2.v20.Identity(
|
2019-01-29 16:52:59 +01:00
|
|
|
id=IDENTITY_ID,
|
2017-06-12 22:15:12 +02:00
|
|
|
created="2015-12-21T19:59:11Z",
|
|
|
|
modified="2015-12-21T19:59:11Z",
|
|
|
|
name="John Smith",
|
|
|
|
identity_class="individual",
|
|
|
|
x_foo="bar",
|
|
|
|
allow_custom=True,
|
|
|
|
)
|
|
|
|
assert identity.x_foo == "bar"
|
|
|
|
|
|
|
|
|
2018-07-13 17:10:05 +02:00
|
|
|
@pytest.mark.parametrize(
|
|
|
|
"data", [
|
|
|
|
"""{
|
2017-06-12 22:15:12 +02:00
|
|
|
"type": "identity",
|
2018-06-27 18:34:49 +02:00
|
|
|
"id": "identity--311b2d2d-f010-4473-83ec-1edf84858f4c",
|
2017-06-12 22:15:12 +02:00
|
|
|
"created": "2015-12-21T19:59:11Z",
|
|
|
|
"modified": "2015-12-21T19:59:11Z",
|
|
|
|
"name": "John Smith",
|
|
|
|
"identity_class": "individual",
|
|
|
|
"foo": "bar"
|
|
|
|
}""",
|
2018-07-13 17:10:05 +02:00
|
|
|
],
|
|
|
|
)
|
2017-06-12 22:15:12 +02:00
|
|
|
def test_parse_identity_custom_property(data):
|
2017-08-24 21:46:36 +02:00
|
|
|
with pytest.raises(stix2.exceptions.ExtraPropertiesError) as excinfo:
|
2018-07-05 21:23:25 +02:00
|
|
|
stix2.parse(data, version="2.0")
|
2019-07-22 22:55:22 +02:00
|
|
|
assert issubclass(excinfo.value.cls, stix2.v20.Identity)
|
2017-08-24 21:46:36 +02:00
|
|
|
assert excinfo.value.properties == ['foo']
|
|
|
|
assert "Unexpected properties for" in str(excinfo.value)
|
2017-06-12 22:15:12 +02:00
|
|
|
|
2018-07-05 21:23:25 +02:00
|
|
|
identity = stix2.parse(data, version="2.0", allow_custom=True)
|
2017-06-12 22:15:12 +02:00
|
|
|
assert identity.foo == "bar"
|
|
|
|
|
|
|
|
|
2018-05-16 21:37:30 +02:00
|
|
|
def test_custom_property_object_in_bundled_object():
|
2018-07-05 21:23:25 +02:00
|
|
|
bundle = stix2.v20.Bundle(IDENTITY_CUSTOM_PROP, allow_custom=True)
|
2018-05-16 18:14:33 +02:00
|
|
|
|
|
|
|
assert bundle.objects[0].x_foo == "bar"
|
|
|
|
assert '"x_foo": "bar"' in str(bundle)
|
|
|
|
|
|
|
|
|
2018-05-17 15:04:44 +02:00
|
|
|
def test_custom_properties_object_in_bundled_object():
|
2018-07-05 21:23:25 +02:00
|
|
|
obj = stix2.v20.Identity(
|
2017-10-09 23:33:12 +02:00
|
|
|
name="John Smith",
|
|
|
|
identity_class="individual",
|
2018-05-17 15:04:44 +02:00
|
|
|
custom_properties={
|
|
|
|
"x_foo": "bar",
|
2018-07-13 17:10:05 +02:00
|
|
|
},
|
2017-10-09 23:33:12 +02:00
|
|
|
)
|
2018-07-05 21:23:25 +02:00
|
|
|
bundle = stix2.v20.Bundle(obj, allow_custom=True)
|
2018-05-17 15:04:44 +02:00
|
|
|
|
|
|
|
assert bundle.objects[0].x_foo == "bar"
|
|
|
|
assert '"x_foo": "bar"' in str(bundle)
|
|
|
|
|
2017-10-09 23:33:12 +02:00
|
|
|
|
2018-05-16 21:37:30 +02:00
|
|
|
def test_custom_property_dict_in_bundled_object():
|
|
|
|
custom_identity = {
|
|
|
|
'type': 'identity',
|
2019-01-29 16:52:59 +01:00
|
|
|
'id': IDENTITY_ID,
|
2018-05-16 21:37:30 +02:00
|
|
|
'created': '2015-12-21T19:59:11Z',
|
|
|
|
'name': 'John Smith',
|
|
|
|
'identity_class': 'individual',
|
|
|
|
'x_foo': 'bar',
|
|
|
|
}
|
Improved the exception class hierarchy:
- Removed all plain python base classes (e.g. ValueError, TypeError)
- Renamed InvalidPropertyConfigurationError -> PropertyPresenceError,
since incorrect values could be considered a property config error, and
I really just wanted this class to apply to presence (co-)constraint
violations.
- Added ObjectConfigurationError as a superclass of InvalidValueError,
PropertyPresenceError, and any other exception that could be raised
during _STIXBase object init, which is when the spec compliance
checks happen. This class is intended to represent general spec
violations.
- Did some class reordering in exceptions.py, so all the
ObjectConfigurationError subclasses were together.
Changed how property "cleaning" errors were handled:
- Previous docs said they should all be ValueErrors, but that would require
extra exception check-and-replace complexity in the property
implementations, so that requirement is removed. Doc is changed to just
say that cleaning problems should cause exceptions to be raised.
_STIXBase._check_property() now handles most exception types, not just
ValueError.
- Decided to try chaining the original clean error to the InvalidValueError,
in case the extra diagnostics would be helpful in the future. This is
done via 'six' adapter function and only works on python3.
- A small amount of testing was removed, since it was looking at custom
exception properties which became unavailable once the exception was
replaced with InvalidValueError.
Did another pass through unit tests to fix breakage caused by the changed
exception class hierarchy.
Removed unnecessary observable extension handling code from
parse_observable(), since it was all duplicated in ExtensionsProperty.
The redundant code in parse_observable() had different exception behavior
than ExtensionsProperty, which makes the API inconsistent and unit tests
more complicated. (Problems in ExtensionsProperty get replaced with
InvalidValueError, but extensions problems handled directly in
parse_observable() don't get the same replacement, and so the exception
type is different.)
Redid the workbench monkeypatching. The old way was impossible to make
work, and had caused ugly ripple effect hackage in other parts of the
codebase. Now, it replaces the global object maps with factory functions
which behave the same way when called, as real classes. Had to fix up a
few unit tests to get them all passing with this monkeypatching in place.
Also remove all the xfail markings in the workbench test suite, since all
tests now pass.
Since workbench monkeypatching isn't currently affecting any unit tests,
tox.ini was simplified to remove the special-casing for running the
workbench tests.
Removed the v20 workbench test suite, since the workbench currently only
works with the latest stix object version.
2019-07-19 20:50:11 +02:00
|
|
|
with pytest.raises(InvalidValueError):
|
2018-07-05 21:23:25 +02:00
|
|
|
stix2.v20.Bundle(custom_identity)
|
2018-05-16 21:37:30 +02:00
|
|
|
|
2018-07-05 21:23:25 +02:00
|
|
|
bundle = stix2.v20.Bundle(custom_identity, allow_custom=True)
|
2017-10-09 23:33:12 +02:00
|
|
|
assert bundle.objects[0].x_foo == "bar"
|
2017-10-12 20:08:32 +02:00
|
|
|
assert '"x_foo": "bar"' in str(bundle)
|
2017-10-09 23:33:12 +02:00
|
|
|
|
|
|
|
|
2018-05-17 15:04:44 +02:00
|
|
|
def test_custom_properties_dict_in_bundled_object():
|
|
|
|
custom_identity = {
|
|
|
|
'type': 'identity',
|
2019-01-29 16:52:59 +01:00
|
|
|
'id': IDENTITY_ID,
|
2018-05-17 15:04:44 +02:00
|
|
|
'created': '2015-12-21T19:59:11Z',
|
|
|
|
'name': 'John Smith',
|
|
|
|
'identity_class': 'individual',
|
|
|
|
'custom_properties': {
|
|
|
|
'x_foo': 'bar',
|
|
|
|
},
|
|
|
|
}
|
2018-07-05 21:23:25 +02:00
|
|
|
bundle = stix2.v20.Bundle(custom_identity)
|
2018-05-16 21:37:30 +02:00
|
|
|
|
|
|
|
assert bundle.objects[0].x_foo == "bar"
|
|
|
|
assert '"x_foo": "bar"' in str(bundle)
|
|
|
|
|
|
|
|
|
2018-05-11 23:28:55 +02:00
|
|
|
def test_custom_property_in_observed_data():
|
2018-07-05 21:23:25 +02:00
|
|
|
artifact = stix2.v20.File(
|
2018-05-11 23:28:55 +02:00
|
|
|
allow_custom=True,
|
|
|
|
name='test',
|
2018-07-13 17:10:05 +02:00
|
|
|
x_foo='bar',
|
2018-05-11 23:28:55 +02:00
|
|
|
)
|
2018-07-05 21:23:25 +02:00
|
|
|
observed_data = stix2.v20.ObservedData(
|
2018-05-11 23:28:55 +02:00
|
|
|
allow_custom=True,
|
|
|
|
first_observed="2015-12-21T19:00:00Z",
|
|
|
|
last_observed="2015-12-21T19:00:00Z",
|
2018-10-17 13:47:25 +02:00
|
|
|
number_observed=1,
|
2018-05-11 23:28:55 +02:00
|
|
|
objects={"0": artifact},
|
|
|
|
)
|
|
|
|
|
|
|
|
assert observed_data.objects['0'].x_foo == "bar"
|
|
|
|
assert '"x_foo": "bar"' in str(observed_data)
|
|
|
|
|
|
|
|
|
2018-05-16 18:14:33 +02:00
|
|
|
def test_custom_property_object_in_observable_extension():
|
2018-07-05 21:23:25 +02:00
|
|
|
ntfs = stix2.v20.NTFSExt(
|
2018-05-16 18:14:33 +02:00
|
|
|
allow_custom=True,
|
|
|
|
sid=1,
|
|
|
|
x_foo='bar',
|
|
|
|
)
|
2018-07-05 21:23:25 +02:00
|
|
|
artifact = stix2.v20.File(
|
2018-05-16 18:14:33 +02:00
|
|
|
name='test',
|
|
|
|
extensions={'ntfs-ext': ntfs},
|
|
|
|
)
|
2018-07-05 21:23:25 +02:00
|
|
|
observed_data = stix2.v20.ObservedData(
|
2018-05-16 18:14:33 +02:00
|
|
|
allow_custom=True,
|
|
|
|
first_observed="2015-12-21T19:00:00Z",
|
|
|
|
last_observed="2015-12-21T19:00:00Z",
|
2018-10-17 13:47:25 +02:00
|
|
|
number_observed=1,
|
2018-05-16 18:14:33 +02:00
|
|
|
objects={"0": artifact},
|
|
|
|
)
|
2017-10-09 23:33:12 +02:00
|
|
|
|
2018-05-16 18:14:33 +02:00
|
|
|
assert observed_data.objects['0'].extensions['ntfs-ext'].x_foo == "bar"
|
|
|
|
assert '"x_foo": "bar"' in str(observed_data)
|
|
|
|
|
|
|
|
|
|
|
|
def test_custom_property_dict_in_observable_extension():
|
Improved the exception class hierarchy:
- Removed all plain python base classes (e.g. ValueError, TypeError)
- Renamed InvalidPropertyConfigurationError -> PropertyPresenceError,
since incorrect values could be considered a property config error, and
I really just wanted this class to apply to presence (co-)constraint
violations.
- Added ObjectConfigurationError as a superclass of InvalidValueError,
PropertyPresenceError, and any other exception that could be raised
during _STIXBase object init, which is when the spec compliance
checks happen. This class is intended to represent general spec
violations.
- Did some class reordering in exceptions.py, so all the
ObjectConfigurationError subclasses were together.
Changed how property "cleaning" errors were handled:
- Previous docs said they should all be ValueErrors, but that would require
extra exception check-and-replace complexity in the property
implementations, so that requirement is removed. Doc is changed to just
say that cleaning problems should cause exceptions to be raised.
_STIXBase._check_property() now handles most exception types, not just
ValueError.
- Decided to try chaining the original clean error to the InvalidValueError,
in case the extra diagnostics would be helpful in the future. This is
done via 'six' adapter function and only works on python3.
- A small amount of testing was removed, since it was looking at custom
exception properties which became unavailable once the exception was
replaced with InvalidValueError.
Did another pass through unit tests to fix breakage caused by the changed
exception class hierarchy.
Removed unnecessary observable extension handling code from
parse_observable(), since it was all duplicated in ExtensionsProperty.
The redundant code in parse_observable() had different exception behavior
than ExtensionsProperty, which makes the API inconsistent and unit tests
more complicated. (Problems in ExtensionsProperty get replaced with
InvalidValueError, but extensions problems handled directly in
parse_observable() don't get the same replacement, and so the exception
type is different.)
Redid the workbench monkeypatching. The old way was impossible to make
work, and had caused ugly ripple effect hackage in other parts of the
codebase. Now, it replaces the global object maps with factory functions
which behave the same way when called, as real classes. Had to fix up a
few unit tests to get them all passing with this monkeypatching in place.
Also remove all the xfail markings in the workbench test suite, since all
tests now pass.
Since workbench monkeypatching isn't currently affecting any unit tests,
tox.ini was simplified to remove the special-casing for running the
workbench tests.
Removed the v20 workbench test suite, since the workbench currently only
works with the latest stix object version.
2019-07-19 20:50:11 +02:00
|
|
|
with pytest.raises(InvalidValueError):
|
2018-07-05 21:23:25 +02:00
|
|
|
stix2.v20.File(
|
2018-05-16 18:14:33 +02:00
|
|
|
name='test',
|
|
|
|
extensions={
|
|
|
|
'ntfs-ext': {
|
|
|
|
'sid': 1,
|
|
|
|
'x_foo': 'bar',
|
2018-07-13 17:10:05 +02:00
|
|
|
},
|
2018-05-16 18:14:33 +02:00
|
|
|
},
|
|
|
|
)
|
|
|
|
|
2018-07-05 21:23:25 +02:00
|
|
|
artifact = stix2.v20.File(
|
2018-05-16 18:14:33 +02:00
|
|
|
allow_custom=True,
|
|
|
|
name='test',
|
|
|
|
extensions={
|
|
|
|
'ntfs-ext': {
|
|
|
|
'allow_custom': True,
|
|
|
|
'sid': 1,
|
|
|
|
'x_foo': 'bar',
|
2018-07-13 17:10:05 +02:00
|
|
|
},
|
2018-05-16 18:14:33 +02:00
|
|
|
},
|
|
|
|
)
|
2018-07-05 21:23:25 +02:00
|
|
|
observed_data = stix2.v20.ObservedData(
|
2018-05-16 18:14:33 +02:00
|
|
|
allow_custom=True,
|
|
|
|
first_observed="2015-12-21T19:00:00Z",
|
|
|
|
last_observed="2015-12-21T19:00:00Z",
|
2018-10-17 13:47:25 +02:00
|
|
|
number_observed=1,
|
2018-05-16 18:14:33 +02:00
|
|
|
objects={"0": artifact},
|
|
|
|
)
|
|
|
|
|
|
|
|
assert observed_data.objects['0'].extensions['ntfs-ext'].x_foo == "bar"
|
|
|
|
assert '"x_foo": "bar"' in str(observed_data)
|
2017-10-09 23:33:12 +02:00
|
|
|
|
|
|
|
|
2018-03-02 17:32:07 +01:00
|
|
|
def test_identity_custom_property_revoke():
|
|
|
|
identity = IDENTITY_CUSTOM_PROP.revoke()
|
|
|
|
assert identity.x_foo == "bar"
|
|
|
|
|
|
|
|
|
|
|
|
def test_identity_custom_property_edit_markings():
|
2018-07-05 21:23:25 +02:00
|
|
|
marking_obj = stix2.v20.MarkingDefinition(
|
2018-03-02 16:21:51 +01:00
|
|
|
id=MARKING_DEFINITION_ID,
|
|
|
|
definition_type="statement",
|
2018-07-13 17:10:05 +02:00
|
|
|
definition=stix2.v20.StatementMarking(statement="Copyright 2016, Example Corp"),
|
2018-03-02 16:21:51 +01:00
|
|
|
)
|
2018-07-05 21:23:25 +02:00
|
|
|
marking_obj2 = stix2.v20.MarkingDefinition(
|
2018-03-02 17:32:07 +01:00
|
|
|
id=MARKING_DEFINITION_ID,
|
|
|
|
definition_type="statement",
|
2018-07-13 17:10:05 +02:00
|
|
|
definition=stix2.v20.StatementMarking(statement="Another one"),
|
2018-03-02 17:32:07 +01:00
|
|
|
)
|
|
|
|
|
|
|
|
# None of the following should throw exceptions
|
|
|
|
identity = IDENTITY_CUSTOM_PROP.add_markings(marking_obj)
|
|
|
|
identity2 = identity.add_markings(marking_obj2, ['x_foo'])
|
|
|
|
identity2.remove_markings(marking_obj.id)
|
|
|
|
identity2.remove_markings(marking_obj2.id, ['x_foo'])
|
|
|
|
identity2.clear_markings()
|
|
|
|
identity2.clear_markings('x_foo')
|
2018-03-02 16:21:51 +01:00
|
|
|
|
|
|
|
|
2017-11-17 14:50:40 +01:00
|
|
|
def test_custom_marking_no_init_1():
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomMarking(
|
|
|
|
'x-new-obj', [
|
|
|
|
('property1', stix2.properties.StringProperty(required=True)),
|
|
|
|
],
|
|
|
|
)
|
2017-11-15 19:12:00 +01:00
|
|
|
class NewObj():
|
|
|
|
pass
|
|
|
|
|
|
|
|
no = NewObj(property1='something')
|
|
|
|
assert no.property1 == 'something'
|
|
|
|
|
2017-11-17 14:50:40 +01:00
|
|
|
|
|
|
|
def test_custom_marking_no_init_2():
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomMarking(
|
|
|
|
'x-new-obj2', [
|
|
|
|
('property1', stix2.properties.StringProperty(required=True)),
|
|
|
|
],
|
|
|
|
)
|
2017-11-15 19:12:00 +01:00
|
|
|
class NewObj2(object):
|
|
|
|
pass
|
|
|
|
|
|
|
|
no2 = NewObj2(property1='something')
|
|
|
|
assert no2.property1 == 'something'
|
|
|
|
|
|
|
|
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomObject(
|
|
|
|
'x-new-type', [
|
|
|
|
('property1', stix2.properties.StringProperty(required=True)),
|
|
|
|
('property2', stix2.properties.IntegerProperty()),
|
|
|
|
],
|
|
|
|
)
|
2017-08-15 19:41:51 +02:00
|
|
|
class NewType(object):
|
2017-06-12 22:15:12 +02:00
|
|
|
def __init__(self, property2=None, **kwargs):
|
2017-06-13 16:26:43 +02:00
|
|
|
if property2 and property2 < 10:
|
2017-06-12 22:15:12 +02:00
|
|
|
raise ValueError("'property2' is too small.")
|
2017-11-17 14:50:40 +01:00
|
|
|
if "property3" in kwargs and not isinstance(kwargs.get("property3"), int):
|
|
|
|
raise TypeError("Must be integer!")
|
|
|
|
|
|
|
|
|
|
|
|
def test_custom_object_raises_exception():
|
|
|
|
with pytest.raises(TypeError) as excinfo:
|
|
|
|
NewType(property1='something', property3='something', allow_custom=True)
|
|
|
|
|
|
|
|
assert str(excinfo.value) == "Must be integer!"
|
2017-06-12 22:15:12 +02:00
|
|
|
|
|
|
|
|
|
|
|
def test_custom_object_type():
|
|
|
|
nt = NewType(property1='something')
|
|
|
|
assert nt.property1 == 'something'
|
|
|
|
|
2017-08-24 21:46:36 +02:00
|
|
|
with pytest.raises(stix2.exceptions.MissingPropertiesError) as excinfo:
|
2017-06-12 22:15:12 +02:00
|
|
|
NewType(property2=42)
|
2017-08-24 21:46:36 +02:00
|
|
|
assert "No values for required properties" in str(excinfo.value)
|
2017-06-12 22:15:12 +02:00
|
|
|
|
2017-08-24 21:46:36 +02:00
|
|
|
with pytest.raises(ValueError) as excinfo:
|
2017-06-13 16:26:43 +02:00
|
|
|
NewType(property1='something', property2=4)
|
2017-08-24 21:46:36 +02:00
|
|
|
assert "'property2' is too small." in str(excinfo.value)
|
2017-06-12 22:15:12 +02:00
|
|
|
|
|
|
|
|
2017-11-17 14:50:40 +01:00
|
|
|
def test_custom_object_no_init_1():
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomObject(
|
|
|
|
'x-new-obj', [
|
|
|
|
('property1', stix2.properties.StringProperty(required=True)),
|
|
|
|
],
|
|
|
|
)
|
2017-09-20 23:13:51 +02:00
|
|
|
class NewObj():
|
|
|
|
pass
|
|
|
|
|
|
|
|
no = NewObj(property1='something')
|
|
|
|
assert no.property1 == 'something'
|
|
|
|
|
2017-11-17 14:50:40 +01:00
|
|
|
|
|
|
|
def test_custom_object_no_init_2():
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomObject(
|
|
|
|
'x-new-obj2', [
|
|
|
|
('property1', stix2.properties.StringProperty(required=True)),
|
|
|
|
],
|
|
|
|
)
|
2017-09-20 23:13:51 +02:00
|
|
|
class NewObj2(object):
|
|
|
|
pass
|
|
|
|
|
|
|
|
no2 = NewObj2(property1='something')
|
|
|
|
assert no2.property1 == 'something'
|
|
|
|
|
|
|
|
|
2018-04-13 20:52:00 +02:00
|
|
|
def test_custom_object_invalid_type_name():
|
|
|
|
with pytest.raises(ValueError) as excinfo:
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomObject(
|
|
|
|
'x', [
|
|
|
|
('property1', stix2.properties.StringProperty(required=True)),
|
|
|
|
],
|
|
|
|
)
|
2018-04-13 20:52:00 +02:00
|
|
|
class NewObj(object):
|
|
|
|
pass # pragma: no cover
|
|
|
|
assert "Invalid type name 'x': " in str(excinfo.value)
|
|
|
|
|
|
|
|
with pytest.raises(ValueError) as excinfo:
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomObject(
|
|
|
|
'x_new_object', [
|
|
|
|
('property1', stix2.properties.StringProperty(required=True)),
|
|
|
|
],
|
|
|
|
)
|
2018-04-13 20:52:00 +02:00
|
|
|
class NewObj2(object):
|
|
|
|
pass # pragma: no cover
|
|
|
|
assert "Invalid type name 'x_new_object':" in str(excinfo.value)
|
|
|
|
|
|
|
|
|
2017-06-12 22:15:12 +02:00
|
|
|
def test_parse_custom_object_type():
|
|
|
|
nt_string = """{
|
2017-06-14 15:34:42 +02:00
|
|
|
"type": "x-new-type",
|
2017-06-12 22:15:12 +02:00
|
|
|
"created": "2015-12-21T19:59:11Z",
|
|
|
|
"property1": "something"
|
|
|
|
}"""
|
|
|
|
|
2018-07-05 21:23:25 +02:00
|
|
|
nt = stix2.parse(nt_string, version="2.0", allow_custom=True)
|
2018-06-14 02:09:07 +02:00
|
|
|
assert nt["property1"] == 'something'
|
2017-06-14 15:34:42 +02:00
|
|
|
|
|
|
|
|
2017-08-24 23:53:43 +02:00
|
|
|
def test_parse_unregistered_custom_object_type():
|
|
|
|
nt_string = """{
|
|
|
|
"type": "x-foobar-observable",
|
|
|
|
"created": "2015-12-21T19:59:11Z",
|
|
|
|
"property1": "something"
|
|
|
|
}"""
|
|
|
|
|
|
|
|
with pytest.raises(stix2.exceptions.ParseError) as excinfo:
|
2018-07-05 21:23:25 +02:00
|
|
|
stix2.parse(nt_string, version="2.0")
|
2017-08-24 23:53:43 +02:00
|
|
|
assert "Can't parse unknown object type" in str(excinfo.value)
|
|
|
|
assert "use the CustomObject decorator." in str(excinfo.value)
|
|
|
|
|
|
|
|
|
2018-03-30 19:21:07 +02:00
|
|
|
def test_parse_unregistered_custom_object_type_w_allow_custom():
|
|
|
|
"""parse an unknown custom object, allowed by passing
|
|
|
|
'allow_custom' flag
|
|
|
|
"""
|
|
|
|
nt_string = """{
|
|
|
|
"type": "x-foobar-observable",
|
|
|
|
"created": "2015-12-21T19:59:11Z",
|
|
|
|
"property1": "something"
|
|
|
|
}"""
|
|
|
|
|
2018-07-05 21:23:25 +02:00
|
|
|
custom_obj = stix2.parse(nt_string, version="2.0", allow_custom=True)
|
2018-03-30 19:21:07 +02:00
|
|
|
assert custom_obj["type"] == "x-foobar-observable"
|
|
|
|
|
|
|
|
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomObservable(
|
|
|
|
'x-new-observable', [
|
|
|
|
('property1', stix2.properties.StringProperty(required=True)),
|
|
|
|
('property2', stix2.properties.IntegerProperty()),
|
|
|
|
('x_property3', stix2.properties.BooleanProperty()),
|
|
|
|
],
|
|
|
|
)
|
2017-06-14 15:34:42 +02:00
|
|
|
class NewObservable():
|
|
|
|
def __init__(self, property2=None, **kwargs):
|
|
|
|
if property2 and property2 < 10:
|
|
|
|
raise ValueError("'property2' is too small.")
|
2017-11-17 14:50:40 +01:00
|
|
|
if "property3" in kwargs and not isinstance(kwargs.get("property3"), int):
|
|
|
|
raise TypeError("Must be integer!")
|
2017-06-14 15:34:42 +02:00
|
|
|
|
|
|
|
|
2017-11-17 14:50:40 +01:00
|
|
|
def test_custom_observable_object_1():
|
2017-06-14 15:34:42 +02:00
|
|
|
no = NewObservable(property1='something')
|
|
|
|
assert no.property1 == 'something'
|
|
|
|
|
2017-11-17 14:50:40 +01:00
|
|
|
|
|
|
|
def test_custom_observable_object_2():
|
2017-08-24 21:46:36 +02:00
|
|
|
with pytest.raises(stix2.exceptions.MissingPropertiesError) as excinfo:
|
2017-06-14 15:34:42 +02:00
|
|
|
NewObservable(property2=42)
|
2017-08-24 21:46:36 +02:00
|
|
|
assert excinfo.value.properties == ['property1']
|
|
|
|
assert "No values for required properties" in str(excinfo.value)
|
2017-06-14 15:34:42 +02:00
|
|
|
|
2017-11-17 14:50:40 +01:00
|
|
|
|
|
|
|
def test_custom_observable_object_3():
|
2017-08-24 21:46:36 +02:00
|
|
|
with pytest.raises(ValueError) as excinfo:
|
2017-06-14 15:34:42 +02:00
|
|
|
NewObservable(property1='something', property2=4)
|
2017-08-24 21:46:36 +02:00
|
|
|
assert "'property2' is too small." in str(excinfo.value)
|
2017-06-14 15:34:42 +02:00
|
|
|
|
|
|
|
|
2017-11-17 14:50:40 +01:00
|
|
|
def test_custom_observable_raises_exception():
|
|
|
|
with pytest.raises(TypeError) as excinfo:
|
|
|
|
NewObservable(property1='something', property3='something', allow_custom=True)
|
|
|
|
|
|
|
|
assert str(excinfo.value) == "Must be integer!"
|
|
|
|
|
|
|
|
|
|
|
|
def test_custom_observable_object_no_init_1():
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomObservable(
|
|
|
|
'x-new-observable', [
|
|
|
|
('property1', stix2.properties.StringProperty()),
|
|
|
|
],
|
|
|
|
)
|
2017-09-20 23:13:51 +02:00
|
|
|
class NewObs():
|
|
|
|
pass
|
|
|
|
|
|
|
|
no = NewObs(property1='something')
|
|
|
|
assert no.property1 == 'something'
|
|
|
|
|
2017-11-17 14:50:40 +01:00
|
|
|
|
|
|
|
def test_custom_observable_object_no_init_2():
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomObservable(
|
|
|
|
'x-new-obs2', [
|
|
|
|
('property1', stix2.properties.StringProperty()),
|
|
|
|
],
|
|
|
|
)
|
2017-09-20 23:13:51 +02:00
|
|
|
class NewObs2(object):
|
|
|
|
pass
|
|
|
|
|
|
|
|
no2 = NewObs2(property1='something')
|
|
|
|
assert no2.property1 == 'something'
|
|
|
|
|
|
|
|
|
2018-04-13 20:52:00 +02:00
|
|
|
def test_custom_observable_object_invalid_type_name():
|
|
|
|
with pytest.raises(ValueError) as excinfo:
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomObservable(
|
|
|
|
'x', [
|
|
|
|
('property1', stix2.properties.StringProperty()),
|
|
|
|
],
|
|
|
|
)
|
2018-04-13 20:52:00 +02:00
|
|
|
class NewObs(object):
|
|
|
|
pass # pragma: no cover
|
|
|
|
assert "Invalid observable type name 'x':" in str(excinfo.value)
|
|
|
|
|
|
|
|
with pytest.raises(ValueError) as excinfo:
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomObservable(
|
|
|
|
'x_new_obs', [
|
|
|
|
('property1', stix2.properties.StringProperty()),
|
|
|
|
],
|
|
|
|
)
|
2018-04-13 20:52:00 +02:00
|
|
|
class NewObs2(object):
|
|
|
|
pass # pragma: no cover
|
|
|
|
assert "Invalid observable type name 'x_new_obs':" in str(excinfo.value)
|
|
|
|
|
|
|
|
|
2017-08-24 23:53:43 +02:00
|
|
|
def test_custom_observable_object_invalid_ref_property():
|
|
|
|
with pytest.raises(ValueError) as excinfo:
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomObservable(
|
|
|
|
'x-new-obs', [
|
|
|
|
('property_ref', stix2.properties.StringProperty()),
|
|
|
|
],
|
|
|
|
)
|
2017-08-30 21:33:28 +02:00
|
|
|
class NewObs():
|
|
|
|
pass
|
2017-08-24 23:53:43 +02:00
|
|
|
assert "is named like an object reference property but is not an ObjectReferenceProperty" in str(excinfo.value)
|
|
|
|
|
|
|
|
|
2017-08-30 21:33:28 +02:00
|
|
|
def test_custom_observable_object_invalid_refs_property():
|
|
|
|
with pytest.raises(ValueError) as excinfo:
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomObservable(
|
|
|
|
'x-new-obs', [
|
|
|
|
('property_refs', stix2.properties.StringProperty()),
|
|
|
|
],
|
|
|
|
)
|
2017-08-30 21:33:28 +02:00
|
|
|
class NewObs():
|
|
|
|
pass
|
2017-08-30 22:15:05 +02:00
|
|
|
assert "is named like an object reference list property but is not a ListProperty containing ObjectReferenceProperty" in str(excinfo.value)
|
2017-08-30 21:33:28 +02:00
|
|
|
|
|
|
|
|
|
|
|
def test_custom_observable_object_invalid_refs_list_property():
|
|
|
|
with pytest.raises(ValueError) as excinfo:
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomObservable(
|
|
|
|
'x-new-obs', [
|
|
|
|
('property_refs', stix2.properties.ListProperty(stix2.properties.StringProperty)),
|
|
|
|
],
|
|
|
|
)
|
2017-08-30 21:33:28 +02:00
|
|
|
class NewObs():
|
|
|
|
pass
|
2017-08-30 22:15:05 +02:00
|
|
|
assert "is named like an object reference list property but is not a ListProperty containing ObjectReferenceProperty" in str(excinfo.value)
|
2017-08-30 21:33:28 +02:00
|
|
|
|
|
|
|
|
2017-08-24 23:53:43 +02:00
|
|
|
def test_custom_observable_object_invalid_valid_refs():
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomObservable(
|
|
|
|
'x-new-obs', [
|
|
|
|
('property1', stix2.properties.StringProperty(required=True)),
|
|
|
|
('property_ref', stix2.properties.ObjectReferenceProperty(valid_types='email-addr')),
|
|
|
|
],
|
|
|
|
)
|
2017-08-24 23:53:43 +02:00
|
|
|
class NewObs():
|
|
|
|
pass
|
|
|
|
|
|
|
|
with pytest.raises(Exception) as excinfo:
|
2018-07-13 17:10:05 +02:00
|
|
|
NewObs(
|
|
|
|
_valid_refs=['1'],
|
|
|
|
property1='something',
|
|
|
|
property_ref='1',
|
|
|
|
)
|
2017-08-24 23:53:43 +02:00
|
|
|
assert "must be created with _valid_refs as a dict, not a list" in str(excinfo.value)
|
2017-06-14 15:34:42 +02:00
|
|
|
|
|
|
|
|
2017-08-28 20:32:05 +02:00
|
|
|
def test_custom_no_properties_raises_exception():
|
2018-07-10 21:56:22 +02:00
|
|
|
with pytest.raises(TypeError):
|
2017-08-28 20:32:05 +02:00
|
|
|
|
2018-07-05 21:23:25 +02:00
|
|
|
@stix2.v20.CustomObject('x-new-object-type')
|
2017-08-28 20:32:05 +02:00
|
|
|
class NewObject1(object):
|
|
|
|
pass
|
|
|
|
|
2017-08-29 21:15:32 +02:00
|
|
|
|
|
|
|
def test_custom_wrong_properties_arg_raises_exception():
|
2017-08-28 21:19:55 +02:00
|
|
|
with pytest.raises(ValueError):
|
2017-08-28 20:32:05 +02:00
|
|
|
|
2018-07-10 21:56:22 +02:00
|
|
|
@stix2.v20.CustomObservable('x-new-object-type', (("prop", stix2.properties.BooleanProperty())))
|
2017-08-29 21:15:32 +02:00
|
|
|
class NewObject2(object):
|
2017-08-28 20:32:05 +02:00
|
|
|
pass
|
|
|
|
|
|
|
|
|
2017-06-14 15:34:42 +02:00
|
|
|
def test_parse_custom_observable_object():
|
|
|
|
nt_string = """{
|
|
|
|
"type": "x-new-observable",
|
|
|
|
"property1": "something"
|
|
|
|
}"""
|
|
|
|
|
2018-07-05 21:23:25 +02:00
|
|
|
nt = stix2.parse_observable(nt_string, [], version='2.0')
|
2018-06-14 02:09:07 +02:00
|
|
|
assert isinstance(nt, stix2.base._STIXBase)
|
2017-06-14 15:34:42 +02:00
|
|
|
assert nt.property1 == 'something'
|
|
|
|
|
|
|
|
|
2017-08-24 21:46:36 +02:00
|
|
|
def test_parse_unregistered_custom_observable_object():
|
|
|
|
nt_string = """{
|
|
|
|
"type": "x-foobar-observable",
|
|
|
|
"property1": "something"
|
|
|
|
}"""
|
|
|
|
|
2019-11-06 16:11:12 +01:00
|
|
|
with pytest.raises(stix2.exceptions.ParseError) as excinfo:
|
2018-07-05 21:23:25 +02:00
|
|
|
stix2.parse_observable(nt_string, version='2.0')
|
2017-08-24 21:46:36 +02:00
|
|
|
assert "Can't parse unknown observable type" in str(excinfo.value)
|
|
|
|
|
2018-07-05 21:23:25 +02:00
|
|
|
parsed_custom = stix2.parse_observable(nt_string, allow_custom=True, version='2.0')
|
2018-04-10 18:54:27 +02:00
|
|
|
assert parsed_custom['property1'] == 'something'
|
|
|
|
with pytest.raises(AttributeError) as excinfo:
|
|
|
|
assert parsed_custom.property1 == 'something'
|
2018-06-14 02:09:07 +02:00
|
|
|
assert not isinstance(parsed_custom, stix2.base._STIXBase)
|
2018-04-10 18:54:27 +02:00
|
|
|
|
|
|
|
|
2018-04-13 17:18:56 +02:00
|
|
|
def test_parse_unregistered_custom_observable_object_with_no_type():
|
|
|
|
nt_string = """{
|
|
|
|
"property1": "something"
|
|
|
|
}"""
|
|
|
|
|
|
|
|
with pytest.raises(stix2.exceptions.ParseError) as excinfo:
|
2018-07-05 21:23:25 +02:00
|
|
|
stix2.parse_observable(nt_string, allow_custom=True, version='2.0')
|
2018-04-13 17:18:56 +02:00
|
|
|
assert "Can't parse observable with no 'type' property" in str(excinfo.value)
|
|
|
|
|
|
|
|
|
2018-04-10 18:54:27 +02:00
|
|
|
def test_parse_observed_data_with_custom_observable():
|
|
|
|
input_str = """{
|
|
|
|
"type": "observed-data",
|
|
|
|
"id": "observed-data--dc20c4ca-a2a3-4090-a5d5-9558c3af4758",
|
|
|
|
"created": "2016-04-06T19:58:16.000Z",
|
|
|
|
"modified": "2016-04-06T19:58:16.000Z",
|
|
|
|
"first_observed": "2015-12-21T19:00:00Z",
|
|
|
|
"last_observed": "2015-12-21T19:00:00Z",
|
|
|
|
"number_observed": 1,
|
|
|
|
"objects": {
|
|
|
|
"0": {
|
|
|
|
"type": "x-foobar-observable",
|
|
|
|
"property1": "something"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}"""
|
2018-07-05 21:23:25 +02:00
|
|
|
parsed = stix2.parse(input_str, version="2.0", allow_custom=True)
|
2018-04-10 18:54:27 +02:00
|
|
|
assert parsed.objects['0']['property1'] == 'something'
|
|
|
|
|
2017-08-24 21:46:36 +02:00
|
|
|
|
|
|
|
def test_parse_invalid_custom_observable_object():
|
|
|
|
nt_string = """{
|
|
|
|
"property1": "something"
|
|
|
|
}"""
|
|
|
|
|
|
|
|
with pytest.raises(stix2.exceptions.ParseError) as excinfo:
|
2018-07-05 21:23:25 +02:00
|
|
|
stix2.parse_observable(nt_string, version='2.0')
|
2017-08-24 21:46:36 +02:00
|
|
|
assert "Can't parse observable with no 'type' property" in str(excinfo.value)
|
|
|
|
|
|
|
|
|
2017-06-14 15:34:42 +02:00
|
|
|
def test_observable_custom_property():
|
2017-08-24 21:46:36 +02:00
|
|
|
with pytest.raises(ValueError) as excinfo:
|
2017-06-14 15:34:42 +02:00
|
|
|
NewObservable(
|
|
|
|
property1='something',
|
|
|
|
custom_properties="foobar",
|
|
|
|
)
|
2017-08-24 21:46:36 +02:00
|
|
|
assert "'custom_properties' must be a dictionary" in str(excinfo.value)
|
2017-06-14 15:34:42 +02:00
|
|
|
|
|
|
|
no = NewObservable(
|
|
|
|
property1='something',
|
|
|
|
custom_properties={
|
|
|
|
"foo": "bar",
|
|
|
|
},
|
|
|
|
)
|
|
|
|
assert no.foo == "bar"
|
|
|
|
|
|
|
|
|
|
|
|
def test_observable_custom_property_invalid():
|
2017-08-24 21:46:36 +02:00
|
|
|
with pytest.raises(stix2.exceptions.ExtraPropertiesError) as excinfo:
|
2017-06-14 15:34:42 +02:00
|
|
|
NewObservable(
|
|
|
|
property1='something',
|
|
|
|
x_foo="bar",
|
|
|
|
)
|
2017-08-24 21:46:36 +02:00
|
|
|
assert excinfo.value.properties == ['x_foo']
|
|
|
|
assert "Unexpected properties for" in str(excinfo.value)
|
2017-06-14 15:34:42 +02:00
|
|
|
|
|
|
|
|
|
|
|
def test_observable_custom_property_allowed():
|
|
|
|
no = NewObservable(
|
|
|
|
property1='something',
|
|
|
|
x_foo="bar",
|
|
|
|
allow_custom=True,
|
|
|
|
)
|
|
|
|
assert no.x_foo == "bar"
|
2017-07-14 20:55:57 +02:00
|
|
|
|
|
|
|
|
|
|
|
def test_observed_data_with_custom_observable_object():
|
|
|
|
no = NewObservable(property1='something')
|
2018-07-05 21:23:25 +02:00
|
|
|
ob_data = stix2.v20.ObservedData(
|
2017-07-14 21:30:19 +02:00
|
|
|
first_observed=FAKE_TIME,
|
|
|
|
last_observed=FAKE_TIME,
|
2017-07-14 20:55:57 +02:00
|
|
|
number_observed=1,
|
|
|
|
objects={'0': no},
|
|
|
|
allow_custom=True,
|
|
|
|
)
|
|
|
|
assert ob_data.objects['0'].property1 == 'something'
|
2017-08-24 00:36:24 +02:00
|
|
|
|
|
|
|
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomExtension(
|
|
|
|
stix2.v20.DomainName, 'x-new-ext', [
|
|
|
|
('property1', stix2.properties.StringProperty(required=True)),
|
|
|
|
('property2', stix2.properties.IntegerProperty()),
|
|
|
|
],
|
|
|
|
)
|
2017-08-24 00:36:24 +02:00
|
|
|
class NewExtension():
|
|
|
|
def __init__(self, property2=None, **kwargs):
|
|
|
|
if property2 and property2 < 10:
|
|
|
|
raise ValueError("'property2' is too small.")
|
2017-11-17 14:50:40 +01:00
|
|
|
if "property3" in kwargs and not isinstance(kwargs.get("property3"), int):
|
|
|
|
raise TypeError("Must be integer!")
|
|
|
|
|
|
|
|
|
|
|
|
def test_custom_extension_raises_exception():
|
|
|
|
with pytest.raises(TypeError) as excinfo:
|
|
|
|
NewExtension(property1='something', property3='something', allow_custom=True)
|
|
|
|
|
|
|
|
assert str(excinfo.value) == "Must be integer!"
|
2017-08-24 00:36:24 +02:00
|
|
|
|
|
|
|
|
|
|
|
def test_custom_extension():
|
|
|
|
ext = NewExtension(property1='something')
|
|
|
|
assert ext.property1 == 'something'
|
|
|
|
|
2017-08-24 21:46:36 +02:00
|
|
|
with pytest.raises(stix2.exceptions.MissingPropertiesError) as excinfo:
|
2017-08-24 00:36:24 +02:00
|
|
|
NewExtension(property2=42)
|
2017-08-24 21:46:36 +02:00
|
|
|
assert excinfo.value.properties == ['property1']
|
2018-07-09 21:20:04 +02:00
|
|
|
assert str(excinfo.value) == "No values for required properties for _CustomExtension: (property1)."
|
2017-08-24 00:36:24 +02:00
|
|
|
|
2017-08-24 21:46:36 +02:00
|
|
|
with pytest.raises(ValueError) as excinfo:
|
2017-08-24 00:36:24 +02:00
|
|
|
NewExtension(property1='something', property2=4)
|
2017-08-24 21:46:36 +02:00
|
|
|
assert str(excinfo.value) == "'property2' is too small."
|
|
|
|
|
|
|
|
|
|
|
|
def test_custom_extension_wrong_observable_type():
|
2018-05-16 18:14:33 +02:00
|
|
|
# NewExtension is an extension of DomainName, not File
|
2017-08-24 21:46:36 +02:00
|
|
|
ext = NewExtension(property1='something')
|
Improved the exception class hierarchy:
- Removed all plain python base classes (e.g. ValueError, TypeError)
- Renamed InvalidPropertyConfigurationError -> PropertyPresenceError,
since incorrect values could be considered a property config error, and
I really just wanted this class to apply to presence (co-)constraint
violations.
- Added ObjectConfigurationError as a superclass of InvalidValueError,
PropertyPresenceError, and any other exception that could be raised
during _STIXBase object init, which is when the spec compliance
checks happen. This class is intended to represent general spec
violations.
- Did some class reordering in exceptions.py, so all the
ObjectConfigurationError subclasses were together.
Changed how property "cleaning" errors were handled:
- Previous docs said they should all be ValueErrors, but that would require
extra exception check-and-replace complexity in the property
implementations, so that requirement is removed. Doc is changed to just
say that cleaning problems should cause exceptions to be raised.
_STIXBase._check_property() now handles most exception types, not just
ValueError.
- Decided to try chaining the original clean error to the InvalidValueError,
in case the extra diagnostics would be helpful in the future. This is
done via 'six' adapter function and only works on python3.
- A small amount of testing was removed, since it was looking at custom
exception properties which became unavailable once the exception was
replaced with InvalidValueError.
Did another pass through unit tests to fix breakage caused by the changed
exception class hierarchy.
Removed unnecessary observable extension handling code from
parse_observable(), since it was all duplicated in ExtensionsProperty.
The redundant code in parse_observable() had different exception behavior
than ExtensionsProperty, which makes the API inconsistent and unit tests
more complicated. (Problems in ExtensionsProperty get replaced with
InvalidValueError, but extensions problems handled directly in
parse_observable() don't get the same replacement, and so the exception
type is different.)
Redid the workbench monkeypatching. The old way was impossible to make
work, and had caused ugly ripple effect hackage in other parts of the
codebase. Now, it replaces the global object maps with factory functions
which behave the same way when called, as real classes. Had to fix up a
few unit tests to get them all passing with this monkeypatching in place.
Also remove all the xfail markings in the workbench test suite, since all
tests now pass.
Since workbench monkeypatching isn't currently affecting any unit tests,
tox.ini was simplified to remove the special-casing for running the
workbench tests.
Removed the v20 workbench test suite, since the workbench currently only
works with the latest stix object version.
2019-07-19 20:50:11 +02:00
|
|
|
with pytest.raises(InvalidValueError) as excinfo:
|
2018-07-05 21:23:25 +02:00
|
|
|
stix2.v20.File(
|
|
|
|
name="abc.txt",
|
|
|
|
extensions={
|
|
|
|
"ntfs-ext": ext,
|
2018-07-13 17:10:05 +02:00
|
|
|
},
|
|
|
|
)
|
2017-08-24 21:46:36 +02:00
|
|
|
|
|
|
|
assert 'Cannot determine extension type' in excinfo.value.reason
|
2017-08-24 00:36:24 +02:00
|
|
|
|
|
|
|
|
2018-07-13 17:10:05 +02:00
|
|
|
@pytest.mark.parametrize(
|
|
|
|
"data", [
|
|
|
|
"""{
|
2018-04-13 17:04:07 +02:00
|
|
|
"keys": [
|
|
|
|
{
|
|
|
|
"test123": 123,
|
|
|
|
"test345": "aaaa"
|
|
|
|
}
|
|
|
|
]
|
|
|
|
}""",
|
2018-07-13 17:10:05 +02:00
|
|
|
],
|
|
|
|
)
|
2018-04-13 17:04:07 +02:00
|
|
|
def test_custom_extension_with_list_and_dict_properties_observable_type(data):
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomExtension(
|
|
|
|
stix2.v20.UserAccount, 'some-extension', [
|
|
|
|
('keys', stix2.properties.ListProperty(stix2.properties.DictionaryProperty, required=True)),
|
|
|
|
],
|
|
|
|
)
|
2018-04-13 17:04:07 +02:00
|
|
|
class SomeCustomExtension:
|
|
|
|
pass
|
|
|
|
|
|
|
|
example = SomeCustomExtension(keys=[{'test123': 123, 'test345': 'aaaa'}])
|
|
|
|
assert data == str(example)
|
|
|
|
|
|
|
|
|
2017-08-24 21:46:36 +02:00
|
|
|
def test_custom_extension_invalid_observable():
|
|
|
|
# These extensions are being applied to improperly-created Observables.
|
|
|
|
# The Observable classes should have been created with the CustomObservable decorator.
|
2017-08-24 00:36:24 +02:00
|
|
|
class Foo(object):
|
|
|
|
pass
|
2017-08-24 21:46:36 +02:00
|
|
|
with pytest.raises(ValueError) as excinfo:
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomExtension(
|
|
|
|
Foo, 'x-new-ext', [
|
|
|
|
('property1', stix2.properties.StringProperty(required=True)),
|
|
|
|
],
|
|
|
|
)
|
2017-08-24 00:36:24 +02:00
|
|
|
class FooExtension():
|
|
|
|
pass # pragma: no cover
|
2017-08-24 21:46:36 +02:00
|
|
|
assert str(excinfo.value) == "'observable' must be a valid Observable class!"
|
2017-08-24 00:36:24 +02:00
|
|
|
|
2018-07-05 21:23:25 +02:00
|
|
|
class Bar(stix2.v20.observables._Observable):
|
2017-08-24 00:36:24 +02:00
|
|
|
pass
|
2017-08-24 21:46:36 +02:00
|
|
|
with pytest.raises(ValueError) as excinfo:
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomExtension(
|
|
|
|
Bar, 'x-new-ext', [
|
|
|
|
('property1', stix2.properties.StringProperty(required=True)),
|
|
|
|
],
|
|
|
|
)
|
2017-08-24 00:36:24 +02:00
|
|
|
class BarExtension():
|
|
|
|
pass
|
2017-08-24 21:46:36 +02:00
|
|
|
assert "Unknown observable type" in str(excinfo.value)
|
|
|
|
assert "Custom observables must be created with the @CustomObservable decorator." in str(excinfo.value)
|
|
|
|
|
2018-07-05 21:23:25 +02:00
|
|
|
class Baz(stix2.v20.observables._Observable):
|
2017-08-24 21:46:36 +02:00
|
|
|
_type = 'Baz'
|
|
|
|
with pytest.raises(ValueError) as excinfo:
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomExtension(
|
|
|
|
Baz, 'x-new-ext', [
|
|
|
|
('property1', stix2.properties.StringProperty(required=True)),
|
|
|
|
],
|
|
|
|
)
|
2017-08-24 21:46:36 +02:00
|
|
|
class BazExtension():
|
|
|
|
pass
|
|
|
|
assert "Unknown observable type" in str(excinfo.value)
|
|
|
|
assert "Custom observables must be created with the @CustomObservable decorator." in str(excinfo.value)
|
2017-08-24 00:36:24 +02:00
|
|
|
|
|
|
|
|
2018-04-13 20:52:00 +02:00
|
|
|
def test_custom_extension_invalid_type_name():
|
|
|
|
with pytest.raises(ValueError) as excinfo:
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomExtension(
|
|
|
|
stix2.v20.File, 'x', {
|
|
|
|
'property1': stix2.properties.StringProperty(required=True),
|
|
|
|
},
|
|
|
|
)
|
2018-04-13 20:52:00 +02:00
|
|
|
class FooExtension():
|
|
|
|
pass # pragma: no cover
|
|
|
|
assert "Invalid extension type name 'x':" in str(excinfo.value)
|
|
|
|
|
|
|
|
with pytest.raises(ValueError) as excinfo:
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomExtension(
|
|
|
|
stix2.File, 'x_new_ext', {
|
|
|
|
'property1': stix2.properties.StringProperty(required=True),
|
|
|
|
},
|
|
|
|
)
|
2018-04-13 20:52:00 +02:00
|
|
|
class BlaExtension():
|
|
|
|
pass # pragma: no cover
|
|
|
|
assert "Invalid extension type name 'x_new_ext':" in str(excinfo.value)
|
|
|
|
|
|
|
|
|
2017-10-06 20:24:46 +02:00
|
|
|
def test_custom_extension_no_properties():
|
2020-03-11 01:24:53 +01:00
|
|
|
with pytest.raises(ValueError):
|
2018-07-05 21:23:25 +02:00
|
|
|
@stix2.v20.CustomExtension(stix2.v20.DomainName, 'x-new-ext2', None)
|
2017-10-06 21:05:39 +02:00
|
|
|
class BarExtension():
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
|
|
def test_custom_extension_empty_properties():
|
2020-03-11 01:24:53 +01:00
|
|
|
with pytest.raises(ValueError):
|
2018-07-05 21:23:25 +02:00
|
|
|
@stix2.v20.CustomExtension(stix2.v20.DomainName, 'x-new-ext2', [])
|
2018-04-09 20:58:52 +02:00
|
|
|
class BarExtension():
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
|
|
def test_custom_extension_dict_properties():
|
2020-03-11 01:24:53 +01:00
|
|
|
with pytest.raises(ValueError):
|
2018-07-05 21:23:25 +02:00
|
|
|
@stix2.v20.CustomExtension(stix2.v20.DomainName, 'x-new-ext2', {})
|
2017-10-06 20:24:46 +02:00
|
|
|
class BarExtension():
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
2017-11-17 14:50:40 +01:00
|
|
|
def test_custom_extension_no_init_1():
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomExtension(
|
|
|
|
stix2.v20.DomainName, 'x-new-extension', [
|
|
|
|
('property1', stix2.properties.StringProperty(required=True)),
|
|
|
|
],
|
|
|
|
)
|
2017-09-20 23:13:51 +02:00
|
|
|
class NewExt():
|
|
|
|
pass
|
|
|
|
|
|
|
|
ne = NewExt(property1="foobar")
|
|
|
|
assert ne.property1 == "foobar"
|
|
|
|
|
2017-11-17 14:50:40 +01:00
|
|
|
|
|
|
|
def test_custom_extension_no_init_2():
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomExtension(
|
|
|
|
stix2.v20.DomainName, 'x-new-ext2', [
|
|
|
|
('property1', stix2.properties.StringProperty(required=True)),
|
|
|
|
],
|
|
|
|
)
|
2017-09-20 23:13:51 +02:00
|
|
|
class NewExt2(object):
|
|
|
|
pass
|
|
|
|
|
|
|
|
ne2 = NewExt2(property1="foobar")
|
|
|
|
assert ne2.property1 == "foobar"
|
|
|
|
|
|
|
|
|
2017-08-24 00:36:24 +02:00
|
|
|
def test_parse_observable_with_custom_extension():
|
|
|
|
input_str = """{
|
|
|
|
"type": "domain-name",
|
|
|
|
"value": "example.com",
|
|
|
|
"extensions": {
|
|
|
|
"x-new-ext": {
|
|
|
|
"property1": "foo",
|
|
|
|
"property2": 12
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}"""
|
|
|
|
|
2018-07-05 21:23:25 +02:00
|
|
|
parsed = stix2.parse_observable(input_str, version='2.0')
|
2017-08-24 00:36:24 +02:00
|
|
|
assert parsed.extensions['x-new-ext'].property2 == 12
|
2017-08-24 21:46:36 +02:00
|
|
|
|
|
|
|
|
2019-08-26 23:10:54 +02:00
|
|
|
def test_custom_and_spec_extension_mix():
|
|
|
|
"""
|
|
|
|
Try to make sure that when allow_custom=True, encountering a custom
|
2019-08-26 23:49:55 +02:00
|
|
|
extension doesn't result in a completely uncleaned extensions property.
|
2019-08-26 23:10:54 +02:00
|
|
|
"""
|
|
|
|
|
|
|
|
file_obs = stix2.v20.File(
|
|
|
|
name="my_file.dat",
|
|
|
|
extensions={
|
|
|
|
"x-custom1": {
|
|
|
|
"a": 1,
|
|
|
|
"b": 2,
|
|
|
|
},
|
|
|
|
"ntfs-ext": {
|
|
|
|
"sid": "S-1-whatever",
|
|
|
|
},
|
|
|
|
"x-custom2": {
|
|
|
|
"z": 99.9,
|
|
|
|
"y": False,
|
|
|
|
},
|
|
|
|
"raster-image-ext": {
|
|
|
|
"image_height": 1024,
|
|
|
|
"image_width": 768,
|
|
|
|
"bits_per_pixel": 32,
|
|
|
|
},
|
|
|
|
},
|
|
|
|
allow_custom=True,
|
|
|
|
)
|
|
|
|
|
|
|
|
assert file_obs.extensions["x-custom1"] == {"a": 1, "b": 2}
|
|
|
|
assert file_obs.extensions["x-custom2"] == {"y": False, "z": 99.9}
|
|
|
|
assert file_obs.extensions["ntfs-ext"].sid == "S-1-whatever"
|
|
|
|
assert file_obs.extensions["raster-image-ext"].image_height == 1024
|
|
|
|
|
|
|
|
# Both of these should have been converted to objects, not left as dicts.
|
|
|
|
assert isinstance(
|
|
|
|
file_obs.extensions["raster-image-ext"], stix2.v20.RasterImageExt,
|
|
|
|
)
|
|
|
|
assert isinstance(
|
|
|
|
file_obs.extensions["ntfs-ext"], stix2.v20.NTFSExt,
|
|
|
|
)
|
|
|
|
|
|
|
|
|
2018-11-29 17:06:27 +01:00
|
|
|
@pytest.mark.parametrize(
|
|
|
|
"data", [
|
|
|
|
# URL is not in EXT_MAP
|
|
|
|
"""{
|
2018-11-01 22:23:55 +01:00
|
|
|
"type": "url",
|
2017-08-24 21:46:36 +02:00
|
|
|
"value": "example.com",
|
|
|
|
"extensions": {
|
|
|
|
"x-foobar-ext": {
|
|
|
|
"property1": "foo",
|
|
|
|
"property2": 12
|
|
|
|
}
|
|
|
|
}
|
2018-11-01 22:23:55 +01:00
|
|
|
}""",
|
2018-11-29 17:06:27 +01:00
|
|
|
# File is in EXT_MAP
|
|
|
|
"""{
|
2018-11-01 22:23:55 +01:00
|
|
|
"type": "file",
|
|
|
|
"name": "foo.txt",
|
|
|
|
"extensions": {
|
|
|
|
"x-foobar-ext": {
|
|
|
|
"property1": "foo",
|
|
|
|
"property2": 12
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}""",
|
2018-11-29 17:06:27 +01:00
|
|
|
],
|
|
|
|
)
|
2018-11-01 22:23:55 +01:00
|
|
|
def test_parse_observable_with_unregistered_custom_extension(data):
|
Improved the exception class hierarchy:
- Removed all plain python base classes (e.g. ValueError, TypeError)
- Renamed InvalidPropertyConfigurationError -> PropertyPresenceError,
since incorrect values could be considered a property config error, and
I really just wanted this class to apply to presence (co-)constraint
violations.
- Added ObjectConfigurationError as a superclass of InvalidValueError,
PropertyPresenceError, and any other exception that could be raised
during _STIXBase object init, which is when the spec compliance
checks happen. This class is intended to represent general spec
violations.
- Did some class reordering in exceptions.py, so all the
ObjectConfigurationError subclasses were together.
Changed how property "cleaning" errors were handled:
- Previous docs said they should all be ValueErrors, but that would require
extra exception check-and-replace complexity in the property
implementations, so that requirement is removed. Doc is changed to just
say that cleaning problems should cause exceptions to be raised.
_STIXBase._check_property() now handles most exception types, not just
ValueError.
- Decided to try chaining the original clean error to the InvalidValueError,
in case the extra diagnostics would be helpful in the future. This is
done via 'six' adapter function and only works on python3.
- A small amount of testing was removed, since it was looking at custom
exception properties which became unavailable once the exception was
replaced with InvalidValueError.
Did another pass through unit tests to fix breakage caused by the changed
exception class hierarchy.
Removed unnecessary observable extension handling code from
parse_observable(), since it was all duplicated in ExtensionsProperty.
The redundant code in parse_observable() had different exception behavior
than ExtensionsProperty, which makes the API inconsistent and unit tests
more complicated. (Problems in ExtensionsProperty get replaced with
InvalidValueError, but extensions problems handled directly in
parse_observable() don't get the same replacement, and so the exception
type is different.)
Redid the workbench monkeypatching. The old way was impossible to make
work, and had caused ugly ripple effect hackage in other parts of the
codebase. Now, it replaces the global object maps with factory functions
which behave the same way when called, as real classes. Had to fix up a
few unit tests to get them all passing with this monkeypatching in place.
Also remove all the xfail markings in the workbench test suite, since all
tests now pass.
Since workbench monkeypatching isn't currently affecting any unit tests,
tox.ini was simplified to remove the special-casing for running the
workbench tests.
Removed the v20 workbench test suite, since the workbench currently only
works with the latest stix object version.
2019-07-19 20:50:11 +02:00
|
|
|
with pytest.raises(InvalidValueError) as excinfo:
|
2018-11-28 17:21:27 +01:00
|
|
|
stix2.parse_observable(data, version='2.0')
|
2018-04-12 22:33:08 +02:00
|
|
|
assert "Can't parse unknown extension type" in str(excinfo.value)
|
2017-10-29 05:09:13 +01:00
|
|
|
|
2018-11-28 17:21:27 +01:00
|
|
|
parsed_ob = stix2.parse_observable(data, allow_custom=True, version='2.0')
|
2018-04-10 18:54:27 +02:00
|
|
|
assert parsed_ob['extensions']['x-foobar-ext']['property1'] == 'foo'
|
2018-06-14 02:09:07 +02:00
|
|
|
assert not isinstance(parsed_ob['extensions']['x-foobar-ext'], stix2.base._STIXBase)
|
2017-10-29 05:09:13 +01:00
|
|
|
|
|
|
|
|
|
|
|
def test_register_custom_object():
|
|
|
|
# Not the way to register custom object.
|
|
|
|
class CustomObject2(object):
|
|
|
|
_type = 'awesome-object'
|
|
|
|
|
2018-07-06 20:11:59 +02:00
|
|
|
stix2.core._register_object(CustomObject2, version="2.0")
|
2017-10-29 05:09:13 +01:00
|
|
|
# Note that we will always check against newest OBJ_MAP.
|
2018-07-05 21:23:25 +02:00
|
|
|
assert (CustomObject2._type, CustomObject2) in stix2.v20.OBJ_MAP.items()
|
2018-04-09 21:18:29 +02:00
|
|
|
|
|
|
|
|
|
|
|
def test_extension_property_location():
|
2018-07-05 21:23:25 +02:00
|
|
|
assert 'extensions' in stix2.v20.OBJ_MAP_OBSERVABLE['x-new-observable']._properties
|
|
|
|
assert 'extensions' not in stix2.v20.EXT_MAP['domain-name']['x-new-ext']._properties
|
2018-06-12 18:32:46 +02:00
|
|
|
|
|
|
|
|
2018-07-13 17:10:05 +02:00
|
|
|
@pytest.mark.parametrize(
|
|
|
|
"data", [
|
|
|
|
"""{
|
2018-06-12 18:32:46 +02:00
|
|
|
"type": "x-example",
|
|
|
|
"id": "x-example--336d8a9f-91f1-46c5-b142-6441bb9f8b8d",
|
|
|
|
"created": "2018-06-12T16:20:58.059Z",
|
|
|
|
"modified": "2018-06-12T16:20:58.059Z",
|
|
|
|
"dictionary": {
|
|
|
|
"key": {
|
|
|
|
"key_a": "value",
|
|
|
|
"key_b": "value"
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}""",
|
2018-07-13 17:10:05 +02:00
|
|
|
],
|
|
|
|
)
|
2018-06-12 18:32:46 +02:00
|
|
|
def test_custom_object_nested_dictionary(data):
|
2018-07-13 17:10:05 +02:00
|
|
|
@stix2.v20.CustomObject(
|
|
|
|
'x-example', [
|
|
|
|
('dictionary', stix2.properties.DictionaryProperty()),
|
|
|
|
],
|
|
|
|
)
|
2018-06-12 18:32:46 +02:00
|
|
|
class Example(object):
|
|
|
|
def __init__(self, **kwargs):
|
|
|
|
pass
|
|
|
|
|
2018-07-13 17:10:05 +02:00
|
|
|
example = Example(
|
|
|
|
id='x-example--336d8a9f-91f1-46c5-b142-6441bb9f8b8d',
|
|
|
|
created='2018-06-12T16:20:58.059Z',
|
|
|
|
modified='2018-06-12T16:20:58.059Z',
|
|
|
|
dictionary={'key': {'key_b': 'value', 'key_a': 'value'}},
|
|
|
|
)
|
2018-06-12 18:32:46 +02:00
|
|
|
|
|
|
|
assert data == str(example)
|