From 977107e71391bd29c81820276fe27e4ac65ca9e2 Mon Sep 17 00:00:00 2001 From: Rich Piazza Date: Mon, 1 Jun 2020 22:34:40 -0400 Subject: [PATCH] 2.0 Start/Stop Quailifer uses StringConstants --- stix2/pattern_visitor.py | 10 ++++++++ stix2/patterns.py | 4 +-- stix2/test/v20/test_pattern_expressions.py | 30 +++++++++++----------- 3 files changed, 27 insertions(+), 17 deletions(-) diff --git a/stix2/pattern_visitor.py b/stix2/pattern_visitor.py index 317ffa1..17e4b3b 100644 --- a/stix2/pattern_visitor.py +++ b/stix2/pattern_visitor.py @@ -40,6 +40,11 @@ def remove_terminal_nodes(parse_tree_nodes): return values +_TIMESTAMP_RE = re.compile(r'\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d{1,6})?Z') + + +def check_for_valid_timetamp_syntax(timestamp_string): + return _TIMESTAMP_RE.match(timestamp_string) @@ -214,6 +219,11 @@ class STIXPatternVisitorForSTIX2(): # Visit a parse tree produced by STIXPatternParser#startStopQualifier. def visitStartStopQualifier(self, ctx): children = self.visitChildren(ctx) + # parser will accept any string, need to make sure it is a full STIX timestamp + t1 = check_for_valid_timetamp_syntax(children[1].value) + t2 = check_for_valid_timetamp_syntax(children[3].value) + if not t1 or not t2: + raise(ValueError("Not a legal timestamp")) return StartStopQualifier(children[1], children[3]) # Visit a parse tree produced by STIXPatternParser#withinQualifier. diff --git a/stix2/patterns.py b/stix2/patterns.py index 8feb280..5d7c0a2 100644 --- a/stix2/patterns.py +++ b/stix2/patterns.py @@ -670,7 +670,7 @@ class StartStopQualifier(_ExpressionQualifier): elif isinstance(start_time, datetime.date): self.start_time = TimestampConstant(start_time) elif isinstance(start_time, StringConstant): - self.start_time = TimestampConstant(start_time.value) + self.start_time = StringConstant(start_time.value) else: raise ValueError("%s is not a valid argument for a Start/Stop Qualifier" % start_time) if isinstance(stop_time, TimestampConstant): @@ -678,7 +678,7 @@ class StartStopQualifier(_ExpressionQualifier): elif isinstance(stop_time, datetime.date): self.stop_time = TimestampConstant(stop_time) elif isinstance(stop_time, StringConstant): - self.stop_time = TimestampConstant(stop_time.value) + self.stop_time = StringConstant(stop_time.value) else: raise ValueError("%s is not a valid argument for a Start/Stop Qualifier" % stop_time) diff --git a/stix2/test/v20/test_pattern_expressions.py b/stix2/test/v20/test_pattern_expressions.py index 1951d3c..4142f15 100644 --- a/stix2/test/v20/test_pattern_expressions.py +++ b/stix2/test/v20/test_pattern_expressions.py @@ -312,8 +312,8 @@ def test_set_op(): def test_timestamp(): - ts = stix2.TimestampConstant('2014-01-13T07:03:17Z') - assert str(ts) == "t'2014-01-13T07:03:17Z'" + ts = stix2.StringConstant('2014-01-13T07:03:17Z') + assert str(ts) == "'2014-01-13T07:03:17Z'" def test_boolean(): @@ -363,11 +363,6 @@ def test_invalid_integer_constant(): stix2.IntegerConstant('foo') -def test_invalid_timestamp_constant(): - with pytest.raises(ValueError): - stix2.TimestampConstant('foo') - - def test_invalid_float_constant(): with pytest.raises(ValueError): stix2.FloatConstant('foo') @@ -461,23 +456,23 @@ def test_invalid_within_qualifier(): def test_startstop_qualifier(): qual = stix2.StartStopQualifier( - stix2.TimestampConstant('2016-06-01T00:00:00Z'), - datetime.datetime(2017, 3, 12, 8, 30, 0), + stix2.StringConstant('2016-06-01T00:00:00Z'), + stix2.StringConstant('2017-03-12T08:30:00Z'), ) - assert str(qual) == "START t'2016-06-01T00:00:00Z' STOP t'2017-03-12T08:30:00Z'" + assert str(qual) == "START '2016-06-01T00:00:00Z' STOP '2017-03-12T08:30:00Z'" qual2 = stix2.StartStopQualifier( - datetime.date(2016, 6, 1), - stix2.TimestampConstant('2016-07-01T00:00:00Z'), + stix2.StringConstant("2016-06-01T00:00:00Z"), + stix2.StringConstant('2016-07-01T00:00:00Z'), ) - assert str(qual2) == "START t'2016-06-01T00:00:00Z' STOP t'2016-07-01T00:00:00Z'" + assert str(qual2) == "START '2016-06-01T00:00:00Z' STOP '2016-07-01T00:00:00Z'" def test_invalid_startstop_qualifier(): with pytest.raises(ValueError): stix2.StartStopQualifier( 'foo', - stix2.TimestampConstant('2016-06-01T00:00:00Z'), + stix2.StringConstant('2016-06-01T00:00:00Z'), ) with pytest.raises(ValueError): @@ -513,7 +508,12 @@ def test_parsing_start_stop_qualified_expression(): assert str( patt_obj, - ) == "[ipv4-addr:value = '1.2.3.4'] START t'2016-06-01T00:00:00Z' STOP t'2017-03-12T08:30:00Z'" + ) == "[ipv4-addr:value = '1.2.3.4'] START '2016-06-01T00:00:00Z' STOP '2017-03-12T08:30:00Z'" + + +def test_parsing_illegal_start_stop_qualified_expression(): + with pytest.raises(ValueError): + patt_obj = create_pattern_object("[ipv4-addr:value = '1.2.3.4'] START '2016-06-01' STOP '2017-03-12T08:30:00Z'", version="2.0") def test_list_constant():