MISP
/
cti-python-stix2
mirror of https://github.com/MISP/cti-python-stix2
2
0
Fork 0
Code Issues Releases Wiki Activity

Fixes #303

master
Desai, Kartikey H 2020-01-27 16:18:41 -05:00 committed by Chris Lenk
parent 4b8fda0c2f
commit 5b07887edc
2 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
stix2/pattern_visitor.py
View File

@ -2,7 +2,9 @@ import importlib
import inspect import inspect
from antlr4 import CommonTokenStream, InputStream from antlr4 import CommonTokenStream, InputStream
from antlr4.tree.Trees import Trees
import six import six
from stix2patterns.exceptions import ParseException
from stix2patterns.grammars.STIXPatternLexer import STIXPatternLexer from stix2patterns.grammars.STIXPatternLexer import STIXPatternLexer
from stix2patterns.grammars.STIXPatternParser import ( from stix2patterns.grammars.STIXPatternParser import (
STIXPatternParser, TerminalNode, STIXPatternParser, TerminalNode,
@ -305,7 +307,10 @@ class STIXPatternVisitorForSTIX2(STIXPatternVisitor):
elif node.symbol.type == STIXPatternParser.BinaryLiteral: elif node.symbol.type == STIXPatternParser.BinaryLiteral:
return BinaryConstant(node.getText(), from_parse_tree=True) return BinaryConstant(node.getText(), from_parse_tree=True)
elif node.symbol.type == STIXPatternParser.StringLiteral: elif node.symbol.type == STIXPatternParser.StringLiteral:
return StringConstant(node.getText().strip('\''), from_parse_tree=True) if node.getText()[0] == "'" and node.getText()[-1] == "'":
return StringConstant(node.getText()[1:-1], from_parse_tree=True)
else:
raise ParseException("The pattern does not start and end with a single quote")
elif node.symbol.type == STIXPatternParser.BoolLiteral: elif node.symbol.type == STIXPatternParser.BoolLiteral:
return BooleanConstant(node.getText()) return BooleanConstant(node.getText())
elif node.symbol.type == STIXPatternParser.TimestampLiteral: elif node.symbol.type == STIXPatternParser.TimestampLiteral:
@ -345,6 +350,7 @@ def create_pattern_object(pattern, module_suffix="", module_name=""):
stream = CommonTokenStream(lexer) stream = CommonTokenStream(lexer)
parser = STIXPatternParser(stream) parser = STIXPatternParser(stream)
parser.buildParseTrees = True parser.buildParseTrees = True
# it always adds a console listener by default... remove it. # it always adds a console listener by default... remove it.
parser.removeErrorListeners() parser.removeErrorListeners()

5
stix2/test/v21/test_pattern_expressions.py
View File

@ -510,3 +510,8 @@ def test_parsing_qualified_expression():
def test_list_constant(): def test_list_constant():
patt_obj = create_pattern_object("[network-traffic:src_ref.value IN ('10.0.0.0', '10.0.0.1', '10.0.0.2')]") patt_obj = create_pattern_object("[network-traffic:src_ref.value IN ('10.0.0.0', '10.0.0.1', '10.0.0.2')]")
assert str(patt_obj) == "[network-traffic:src_ref.value IN ('10.0.0.0', '10.0.0.1', '10.0.0.2')]" assert str(patt_obj) == "[network-traffic:src_ref.value IN ('10.0.0.0', '10.0.0.1', '10.0.0.2')]"
def test_parsing_multiple_slashes_quotes():
patt_obj = create_pattern_object("[ file:name = 'weird_name\\'' ]")
assert str(patt_obj) == "[file:name = 'weird_name\\'']"