MISP
/
cti-python-stix2
mirror of https://github.com/MISP/cti-python-stix2
2
0
Fork 0
Code Issues Releases Wiki Activity

2.0 Start/Stop Quailifer uses StringConstants

pull/1/head
Rich Piazza 2020-06-01 22:34:40 -04:00
parent cfe0648c98
commit 977107e713
3 changed files with 27 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
stix2/pattern_visitor.py
View File

@ -40,6 +40,11 @@ def remove_terminal_nodes(parse_tree_nodes):
return values
_TIMESTAMP_RE = re.compile(r'\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,6})?Z')
def check_for_valid_timetamp_syntax(timestamp_string):
return _TIMESTAMP_RE.match(timestamp_string)
@ -214,6 +219,11 @@ class STIXPatternVisitorForSTIX2():
# Visit a parse tree produced by STIXPatternParser#startStopQualifier.
def visitStartStopQualifier(self, ctx):
children = self.visitChildren(ctx)
# parser will accept any string, need to make sure it is a full STIX timestamp
t1 = check_for_valid_timetamp_syntax(children[1].value)
t2 = check_for_valid_timetamp_syntax(children[3].value)
if not t1 or not t2:
raise(ValueError("Not a legal timestamp"))
return StartStopQualifier(children[1], children[3])
# Visit a parse tree produced by STIXPatternParser#withinQualifier.

4
stix2/patterns.py
View File

@ -670,7 +670,7 @@ class StartStopQualifier(_ExpressionQualifier):
elif isinstance(start_time, datetime.date):
self.start_time = TimestampConstant(start_time)
elif isinstance(start_time, StringConstant):
self.start_time = TimestampConstant(start_time.value)
self.start_time = StringConstant(start_time.value)
else:
raise ValueError("%s is not a valid argument for a Start/Stop Qualifier" % start_time)
if isinstance(stop_time, TimestampConstant):
@ -678,7 +678,7 @@ class StartStopQualifier(_ExpressionQualifier):
elif isinstance(stop_time, datetime.date):
self.stop_time = TimestampConstant(stop_time)
elif isinstance(stop_time, StringConstant):
self.stop_time = TimestampConstant(stop_time.value)
self.stop_time = StringConstant(stop_time.value)
else:
raise ValueError("%s is not a valid argument for a Start/Stop Qualifier" % stop_time)

30
stix2/test/v20/test_pattern_expressions.py
View File

@ -312,8 +312,8 @@ def test_set_op():
def test_timestamp():
ts = stix2.TimestampConstant('2014-01-13T07:03:17Z')
assert str(ts) == "t'2014-01-13T07:03:17Z'"
ts = stix2.StringConstant('2014-01-13T07:03:17Z')
assert str(ts) == "'2014-01-13T07:03:17Z'"
def test_boolean():
@ -363,11 +363,6 @@ def test_invalid_integer_constant():
stix2.IntegerConstant('foo')
def test_invalid_timestamp_constant():
with pytest.raises(ValueError):
stix2.TimestampConstant('foo')
def test_invalid_float_constant():
with pytest.raises(ValueError):
stix2.FloatConstant('foo')
@ -461,23 +456,23 @@ def test_invalid_within_qualifier():
def test_startstop_qualifier():
qual = stix2.StartStopQualifier(
stix2.TimestampConstant('2016-06-01T00:00:00Z'),
datetime.datetime(2017, 3, 12, 8, 30, 0),
stix2.StringConstant('2016-06-01T00:00:00Z'),
stix2.StringConstant('2017-03-12T08:30:00Z'),
)
assert str(qual) == "START t'2016-06-01T00:00:00Z' STOP t'2017-03-12T08:30:00Z'"
assert str(qual) == "START '2016-06-01T00:00:00Z' STOP '2017-03-12T08:30:00Z'"
qual2 = stix2.StartStopQualifier(
datetime.date(2016, 6, 1),
stix2.TimestampConstant('2016-07-01T00:00:00Z'),
stix2.StringConstant("2016-06-01T00:00:00Z"),
stix2.StringConstant('2016-07-01T00:00:00Z'),
)
assert str(qual2) == "START t'2016-06-01T00:00:00Z' STOP t'2016-07-01T00:00:00Z'"
assert str(qual2) == "START '2016-06-01T00:00:00Z' STOP '2016-07-01T00:00:00Z'"
def test_invalid_startstop_qualifier():
with pytest.raises(ValueError):
stix2.StartStopQualifier(
'foo',
stix2.TimestampConstant('2016-06-01T00:00:00Z'),
stix2.StringConstant('2016-06-01T00:00:00Z'),
)
with pytest.raises(ValueError):
@ -513,7 +508,12 @@ def test_parsing_start_stop_qualified_expression():
assert str(
patt_obj,
) == "[ipv4-addr:value = '1.2.3.4'] START t'2016-06-01T00:00:00Z' STOP t'2017-03-12T08:30:00Z'"
) == "[ipv4-addr:value = '1.2.3.4'] START '2016-06-01T00:00:00Z' STOP '2017-03-12T08:30:00Z'"
def test_parsing_illegal_start_stop_qualified_expression():
with pytest.raises(ValueError):
patt_obj = create_pattern_object("[ipv4-addr:value = '1.2.3.4'] START '2016-06-01' STOP '2017-03-12T08:30:00Z'", version="2.0")
def test_list_constant():