MISP
/
cti-python-stix2
mirror of https://github.com/MISP/cti-python-stix2
2
0
Fork 0
Code Issues Releases Wiki Activity

Temp backup of some code changes. More coming soon

master
Desai, Kartikey H 2019-09-06 00:25:42 -04:00
parent abf2980336
commit 8f773fd556
5 changed files with 48 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
stix2/base.py
View File

@ -323,6 +323,11 @@ class _Observable(_STIXBase):
super(_Observable, self).__init__(**kwargs)
def _check_ref(self, ref, prop, prop_name):
"""
Only for checking `*_ref` or `*_refs` properties in spec_version 2.0
STIX Cyber Observables (SCOs)
"""
if '*' in self._STIXBase__valid_refs:
return # don't check if refs are valid

16
stix2/datastore/filters.py
View File

@ -90,6 +90,14 @@ class Filter(collections.namedtuple('Filter', ['property', 'op', 'value'])):
filter_value = self.value
if self.op == "=":
boolA = stix_obj_property == filter_value
if boolA is False:
print ('$$$$$')
print (stix_obj_property)
print ('\n')
print (filter_value)
print ('\n')
print ('$$$$$')
return stix_obj_property == filter_value
elif self.op == "!=":
return stix_obj_property != filter_value
@ -97,6 +105,14 @@ class Filter(collections.namedtuple('Filter', ['property', 'op', 'value'])):
return stix_obj_property in filter_value
elif self.op == "contains":
if isinstance(filter_value, dict):
boolB = filter_value in stix_obj_property.values()
if boolB is False:
print ('$$$$$')
print (filter_value)
print ('\n')
print (stix_obj_property.values())
print ('\n')
print ('$$$$$')
return filter_value in stix_obj_property.values()
else:
return filter_value in stix_obj_property

4
stix2/properties.py
View File

@ -462,12 +462,12 @@ class ReferenceProperty(Property):
if possible_prefix[:-2] in self.valid_types:
required_prefix = possible_prefix
else:
raise ValueError("The type-specifying prefix '%s' for the identifier '%s' is not valid" % (possible_prefix, value))
raise ValueError("The type-specifying prefix '%s' for this property is not valid" % (possible_prefix))
elif self.invalid_types:
if possible_prefix[:-2] not in self.invalid_types:
required_prefix = possible_prefix
else:
raise ValueError("An invalid type-specifying prefix '%s' was specified for the identifier '%s'" % (possible_prefix, value))
raise ValueError("An invalid type-specifying prefix '%s' was specified for this property" % (possible_prefix, value))
_validate_id(value, self.spec_version, required_prefix)

5
stix2/test/v21/test_datastore_filters.py
View File

@ -86,6 +86,7 @@ stix_objs = [
"objects": {
"0": {
"type": "file",
"spec_version": "2.1",
"id": "file--42a7175a-42cc-508f-8fa7-23b330aff876",
"name": "HAL 9000.exe",
},
@ -110,8 +111,8 @@ filters = [
Filter("object_marking_refs", "=", "marking-definition--613f2e26-0000-4000-8000-b8e91df99dc9"),
Filter("granular_markings.selectors", "in", "description"),
Filter("external_references.source_name", "=", "CVE"),
Filter("objects", "=", {"0": {"type": "file", "name": "HAL 9000.exe", "id": "file--42a7175a-42cc-508f-8fa7-23b330aff876"}}),
Filter("objects", "contains", {"type": "file", "name": "HAL 9000.exe", "id": "file--42a7175a-42cc-508f-8fa7-23b330aff876"}),
Filter("objects", "=", {"0": {"type": "file", "spec_version": "2.1", "id": "file--42a7175a-42cc-508f-8fa7-23b330aff876", "name": "HAL 9000.exe"}}),
Filter("objects", "contains", {"type": "file", "id": "file--42a7175a-42cc-508f-8fa7-23b330aff876", "name": "HAL 9000.exe", "spec_version": "2.1"}),
Filter("labels", "contains", "heartbleed"),
]

31
stix2/test/v21/test_observed_data.py
View File

@ -27,6 +27,7 @@ EXPECTED = """{
"0": {
"type": "file",
"id": "file--5956efbb-a7b0-566d-a7f9-a202eb05c70f",
"spec_version": "2.1",
"name": "foo.exe"
}
}
@ -44,14 +45,19 @@ def test_observed_data_example():
number_observed=50,
objects={
"0": {
"name": "foo.exe",
"id": "file--5956efbb-a7b0-566d-a7f9-a202eb05c70f",
"type": "file",
"id": "file--5956efbb-a7b0-566d-a7f9-a202eb05c70f",
"name": "foo.exe",
},
},
)
assert str(observed_data) == EXPECTED
assert observed_data.id == "observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf"
assert observed_data.created_by_ref == "identity--311b2d2d-f010-4473-83ec-1edf84858f4c"
assert observed_data.created == observed_data.modified == dt.datetime(2016, 4, 6, 19, 58, 16, tzinfo=pytz.utc)
assert observed_data.first_observed == observed_data.last_observed == dt.datetime(2015, 12, 21, 19, 00, 00, tzinfo=pytz.utc)
assert observed_data.number_observed == 50
assert observed_data.objects['0'] == stix2.v21.File(name="foo.exe")
EXPECTED_WITH_REF = """{
@ -68,11 +74,13 @@ EXPECTED_WITH_REF = """{
"0": {
"type": "file",
"id": "file--5956efbb-a7b0-566d-a7f9-a202eb05c70f",
"spec_version": "2.1",
"name": "foo.exe"
},
"1": {
"type": "directory",
"id": "directory--536a61a4-0934-516b-9aad-fcbb75e0583a",
"spec_version": "2.1",
"path": "/usr/home",
"contains_refs": [
"file--5956efbb-a7b0-566d-a7f9-a202eb05c70f"
@ -93,9 +101,9 @@ def test_observed_data_example_with_refs():
number_observed=50,
objects={
"0": {
"name": "foo.exe",
"id": "file--5956efbb-a7b0-566d-a7f9-a202eb05c70f",
"type": "file",
"id": "file--5956efbb-a7b0-566d-a7f9-a202eb05c70f",
"name": "foo.exe",
},
"1": {
"type": "directory",
@ -105,8 +113,13 @@ def test_observed_data_example_with_refs():
},
},
)
assert str(observed_data) == EXPECTED_WITH_REF
assert observed_data.id == "observed-data--b67d30ff-02ac-498a-92f9-32f845f448cf"
assert observed_data.created_by_ref == "identity--311b2d2d-f010-4473-83ec-1edf84858f4c"
assert observed_data.created == observed_data.modified == dt.datetime(2016, 4, 6, 19, 58, 16, tzinfo=pytz.utc)
assert observed_data.first_observed == observed_data.last_observed == dt.datetime(2015, 12, 21, 19, 00, 00, tzinfo=pytz.utc)
assert observed_data.number_observed == 50
assert observed_data.objects['0'] == stix2.v21.File(name="foo.exe")
assert observed_data.objects['1'] == stix2.v21.Directory(path="/usr/home", contains_refs=["file--5956efbb-a7b0-566d-a7f9-a202eb05c70f"])
EXPECTED_OBJECT_REFS = """{
@ -171,7 +184,7 @@ def test_observed_data_object_constraint():
def test_observed_data_example_with_bad_refs():
with pytest.raises(ValueError) as excinfo:
with pytest.raises(stix2.exceptions.InvalidValueError) as excinfo:
stix2.v21.ObservedData(
id=OBSERVED_DATA_ID,
created_by_ref=IDENTITY_ID,
@ -196,7 +209,7 @@ def test_observed_data_example_with_bad_refs():
assert excinfo.value.cls == stix2.v21.Directory
assert excinfo.value.prop_name == "contains_refs"
assert "The type-specifying prefix 'monkey--' for the identifier" in excinfo.value.reason
assert "The type-specifying prefix 'monkey--' for this property is not valid" in excinfo.value.reason
def test_observed_data_example_with_non_dictionary():