diff --git a/stix2/patterns.py b/stix2/patterns.py index 6592335..8feb280 100644 --- a/stix2/patterns.py +++ b/stix2/patterns.py @@ -669,12 +669,16 @@ class StartStopQualifier(_ExpressionQualifier): self.start_time = start_time elif isinstance(start_time, datetime.date): self.start_time = TimestampConstant(start_time) + elif isinstance(start_time, StringConstant): + self.start_time = TimestampConstant(start_time.value) else: raise ValueError("%s is not a valid argument for a Start/Stop Qualifier" % start_time) if isinstance(stop_time, TimestampConstant): self.stop_time = stop_time elif isinstance(stop_time, datetime.date): self.stop_time = TimestampConstant(stop_time) + elif isinstance(stop_time, StringConstant): + self.stop_time = TimestampConstant(stop_time.value) else: raise ValueError("%s is not a valid argument for a Start/Stop Qualifier" % stop_time) diff --git a/stix2/test/v20/test_pattern_expressions.py b/stix2/test/v20/test_pattern_expressions.py index d5cbb5b..1951d3c 100644 --- a/stix2/test/v20/test_pattern_expressions.py +++ b/stix2/test/v20/test_pattern_expressions.py @@ -508,6 +508,14 @@ def test_parsing_qualified_expression(): ) == "[network-traffic:dst_ref.type = 'domain-name' AND network-traffic:dst_ref.value = 'example.com'] REPEATS 5 TIMES WITHIN 1800 SECONDS" +def test_parsing_start_stop_qualified_expression(): + patt_obj = create_pattern_object("[ipv4-addr:value = '1.2.3.4'] START '2016-06-01T00:00:00Z' STOP '2017-03-12T08:30:00Z'", version="2.0") + + assert str( + patt_obj, + ) == "[ipv4-addr:value = '1.2.3.4'] START t'2016-06-01T00:00:00Z' STOP t'2017-03-12T08:30:00Z'" + + def test_list_constant(): patt_obj = create_pattern_object("[network-traffic:src_ref.value IN ('10.0.0.0', '10.0.0.1', '10.0.0.2')]", version="2.0") assert str(patt_obj) == "[network-traffic:src_ref.value IN ('10.0.0.0', '10.0.0.1', '10.0.0.2')]"