datetimes: I'd converted the object property instead of the
filter value! :-P
Also, I fixed filter validation: it was checking for exact types
of the filter values and disallowing subtypes. This library
includes a datetime subtype named STIXdatetime, and this type
should be usable as a filter value too. So we need to allow
subtypes.
Timestamp properties can now be checked against filter values
which are either strings or datetime objects, using datetime
semantics (previously, it reduced to a string compare).
If a stix object property is datetime-valued and the filter
value is a string, the string is parsed to a datetime object,
rather than the other way around.
Filtering in the filesystem store now parses JSON dicts to
_STIXBase objects before applying the filters.
Due to the parsing change, bad JSON content can produce a
different kind of error, so I had to change one of the tests.
datastore test suite. Add a new test corpus file, located so
as to test the backward compatibility functionality of
FileSystemSource. Add a test to the suite which ensures that
this new file is found.
objects are searched for as ID-named json files in the type
directories, in addition to timestamp-named files in ID
directories.
Made a bugfix: fixed improper exception re-raises
Made an efficiency improvement: don't stat() files in
_get_matching_dir_entries() if no st_mode_test callable is given.
test data corpus. Updated filesystem store tests accordingly:
- Remove comments from all_versions tests stating that multiple
versions are not supported. Improve the tests to ensure that
all versions are in fact retrieved.
- Update the get() test to assure that it gets only the latest
version, when there is more than one version.
- Update some count checks, since there are more objects now
- Fix some typos
store:
- Use utils.get_type_from_id() instead of my own (I didn't know it
was already there)
- Use dict-style instead of attribute-style access to get stix
object properties
- Convert timezone-aware timestamps to UTC in _timestamp2filename()
to ensure that different times always result in different
filenames.
Also added a couple new tests for _timestamp2filename(), which
exercises the timezone conversion code.
Factored out the _is_marking() function from the memory datastore
module to utils so it can be reused, and changed both filesystem
and memory datastore modules to import and use it.
test data corpus. Updated filesystem store tests accordingly:
- Remove comments from all_versions tests stating that multiple
versions are not supported. Improve the tests to ensure that
all versions are in fact retrieved.
- Update the get() test to assure that it gets only the latest
version, when there is more than one version.
- Update some count checks, since there are more objects now
- Fix some typos
store:
- Use utils.get_type_from_id() instead of my own (I didn't know it
was already there)
- Use dict-style instead of attribute-style access to get stix
object properties
- Convert timezone-aware timestamps to UTC in _timestamp2filename()
to ensure that different times always result in different
filenames.
Also added a couple new tests for _timestamp2filename(), which
exercises the timezone conversion code.
Factored out the _is_marking() function from the memory datastore
module to utils so it can be reused, and changed both filesystem
and memory datastore modules to import and use it.
Whether or not the Observable type is in the EXT_MAP already, using a
custom extension without also using allow_custom=True should result in
the same behavior/error message.
A marking definition's `created` property doesn't require millisecond
preprecision, but for TLP markings the TLP instances provided in the
spec must be used and they all use millisecond precision.
Michael Chisholm