From 99bf4215a3e79aaacc998eb99a4a2440f3160ceb Mon Sep 17 00:00:00 2001 From: Michael Chisholm Date: Fri, 5 Jun 2020 16:55:41 -0400 Subject: [PATCH 1/2] Change all uses of ObjectReferenceProperty in 2.1 SCO classes to ReferenceProperty. Add a unit test to ensure that when a stix2 object is passed as a value of a ReferenceProperty, that the ID is properly pulled out and used as the actual property value, and that it doesn't affect the deterministic ID calculation. --- stix2/test/v21/test_observed_data.py | 21 +++++++++++++++++++++ stix2/v21/observables.py | 11 +++++------ 2 files changed, 26 insertions(+), 6 deletions(-) diff --git a/stix2/test/v21/test_observed_data.py b/stix2/test/v21/test_observed_data.py index ceca8f1..8cf2389 100644 --- a/stix2/test/v21/test_observed_data.py +++ b/stix2/test/v21/test_observed_data.py @@ -900,6 +900,27 @@ def test_file_example_with_RasterImageExt_Object(): assert f.extensions["raster-image-ext"].exif_tags["XResolution"] == 4928 +def test_file_with_archive_ext_object(): + ad = stix2.v21.Directory(path="archived/path") + f_obj = stix2.v21.File( + name="foo", extensions={ + "archive-ext": { + "contains_refs": [ad, ], + }, + }, + ) + f_ref = stix2.v21.File( + name="foo", extensions={ + "archive-ext": { + "contains_refs": [ad.id, ], + }, + }, + ) + + assert f_obj["id"] == f_ref["id"] + assert f_obj["extensions"]["archive-ext"]["contains_refs"][0] == ad["id"] + + RASTER_IMAGE_EXT = """{ "type": "observed-data", "spec_version": "2.1", diff --git a/stix2/v21/observables.py b/stix2/v21/observables.py index d73c1cf..a15d5bd 100644 --- a/stix2/v21/observables.py +++ b/stix2/v21/observables.py @@ -14,8 +14,7 @@ from ..properties import ( BinaryProperty, BooleanProperty, DictionaryProperty, EmbeddedObjectProperty, EnumProperty, ExtensionsProperty, FloatProperty, HashesProperty, HexProperty, IDProperty, IntegerProperty, ListProperty, - ObjectReferenceProperty, ReferenceProperty, StringProperty, - TimestampProperty, TypeProperty, + ReferenceProperty, StringProperty, TimestampProperty, TypeProperty, ) from .base import _Extension, _Observable, _STIXBase21 from .common import GranularMarking @@ -144,7 +143,7 @@ class EmailMIMEComponent(_STIXBase21): _properties = OrderedDict([ ('body', StringProperty()), - ('body_raw_ref', ObjectReferenceProperty(valid_types=['artifact', 'file'])), + ('body_raw_ref', ReferenceProperty(valid_types=['artifact', 'file'], spec_version="2.1")), ('content_type', StringProperty()), ('content_disposition', StringProperty()), ]) @@ -201,7 +200,7 @@ class ArchiveExt(_Extension): _type = 'archive-ext' _properties = OrderedDict([ - ('contains_refs', ListProperty(ObjectReferenceProperty(valid_types=['file', 'directory']), required=True)), + ('contains_refs', ListProperty(ReferenceProperty(valid_types=['file', 'directory'], spec_version="2.1"), required=True)), ('comment', StringProperty()), ]) @@ -465,7 +464,7 @@ class HTTPRequestExt(_Extension): ('request_version', StringProperty()), ('request_header', DictionaryProperty(spec_version='2.1')), ('message_body_length', IntegerProperty()), - ('message_body_data_ref', ObjectReferenceProperty(valid_types='artifact')), + ('message_body_data_ref', ReferenceProperty(valid_types='artifact', spec_version="2.1")), ]) @@ -654,7 +653,7 @@ class WindowsServiceExt(_Extension): "SERVICE_SYSTEM_ALERT", ]), ), - ('service_dll_refs', ListProperty(ObjectReferenceProperty(valid_types='file'))), + ('service_dll_refs', ListProperty(ReferenceProperty(valid_types='file', spec_version="2.1"))), ( 'service_type', EnumProperty(allowed=[ "SERVICE_KERNEL_DRIVER", From 00b78e7a47f367d2b020e890950ca05a504cb9c2 Mon Sep 17 00:00:00 2001 From: Michael Chisholm Date: Mon, 8 Jun 2020 17:51:13 -0400 Subject: [PATCH 2/2] Stylistic pre-commit junk --- stix2/base.py | 4 +++- stix2/test/v21/test_deterministic_ids.py | 18 ++++++++++-------- stix2/test/v21/test_observed_data.py | 1 - 3 files changed, 13 insertions(+), 10 deletions(-) diff --git a/stix2/base.py b/stix2/base.py index 7336285..910042a 100644 --- a/stix2/base.py +++ b/stix2/base.py @@ -537,8 +537,10 @@ _JSON_ESCAPE_MAP = { "f": "\f", "n": "\n", "r": "\r", - "t": "\t" + "t": "\t", } + + def _un_json_escape(json_string): """ Removes JSON string literal escapes. We should undo these things Python's diff --git a/stix2/test/v21/test_deterministic_ids.py b/stix2/test/v21/test_deterministic_ids.py index da72142..1e6e2d4 100644 --- a/stix2/test/v21/test_deterministic_ids.py +++ b/stix2/test/v21/test_deterministic_ids.py @@ -189,14 +189,16 @@ def test_empty_hash(): SomeSCO(hashes={}) -@pytest.mark.parametrize("json_escaped, expected_unescaped", [ - ("", ""), - ("a", "a"), - (r"\n", "\n"), - (r"\n\r\b\t\\\/\"", "\n\r\b\t\\/\""), - (r"\\n", r"\n"), - (r"\\\n", "\\\n") -]) +@pytest.mark.parametrize( + "json_escaped, expected_unescaped", [ + ("", ""), + ("a", "a"), + (r"\n", "\n"), + (r"\n\r\b\t\\\/\"", "\n\r\b\t\\/\""), + (r"\\n", r"\n"), + (r"\\\n", "\\\n"), + ], +) def test_json_unescaping(json_escaped, expected_unescaped): actual_unescaped = stix2.base._un_json_escape(json_escaped) assert actual_unescaped == expected_unescaped diff --git a/stix2/test/v21/test_observed_data.py b/stix2/test/v21/test_observed_data.py index 8cf2389..e0fa456 100644 --- a/stix2/test/v21/test_observed_data.py +++ b/stix2/test/v21/test_observed_data.py @@ -1,6 +1,5 @@ import datetime as dt import re -import uuid import pytest import pytz