Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix STIX version detection from dicts #337

Merged
merged 3 commits into from
Feb 13, 2020

Conversation

chisholm
Copy link
Contributor

@chisholm chisholm commented Feb 7, 2020

Fixes #318 .

In particular, 2.1 SCOs without the spec_version property ought to be correctly detected as 2.1 now. This is done based on the presence of an ID property, and that their type is in the 2.1 observable type mapping.

The functionality is factored out into a dedicated function. This allows reuse, including recursive reuse when detecting bundle spec version from the spec versions of its contents. Also added a unit test suite specifically for this capability.

Note that scanning bundle contents is not currently strictly necessary for determining bundle spec version: if spec_version is present => 2.0, else 2.1. This is trivially detectable. I thought maybe the original scan was intended for future-proofing, under the assumption that a 2.1+ bundle would never be allowed to hold SCOs of a version later than the bundle spec version. So I kept it. That implies that 2.1+ bundle spec version could be computed as the max of the spec versions of its contents, with a 2.1 minimum. In theory, maybe the correct conclusion is the bundle spec version is not less than the max contained object spec version (so could be a range of versions greater or equal), but we are currently only dealing with two versions, 2.0 and 2.1, and I think some of the bridges are best crossed when we come to them. (In fact, that may argue for not bothering with a scan at all at this point.)

without the spec_version property ought to be correctly detected
as 2.1 now.
pre-commit add-trailing-comma library.  Hopefully this satisfies
the travis tests for other versions of python!
@codecov-io
Copy link

Codecov Report

Merging #337 into master will increase coverage by 0.04%.
The diff coverage is 100%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master     #337      +/-   ##
==========================================
+ Coverage   98.12%   98.17%   +0.04%     
==========================================
  Files         123      124       +1     
  Lines       13839    14168     +329     
==========================================
+ Hits        13580    13909     +329     
  Misses        259      259
Impacted Files Coverage Δ
stix2/core.py 100% <100%> (ø) ⬆️
stix2/test/test_spec_version_detect.py 100% <100%> (ø)
stix2/test/v21/test_relationship.py 100% <0%> (ø) ⬆️
stix2/test/v20/test_campaign.py 100% <0%> (ø) ⬆️
stix2/test/v21/test_core.py 100% <0%> (ø) ⬆️
stix2/test/v21/test_attack_pattern.py 100% <0%> (ø) ⬆️
stix2/test/v21/test_custom.py 100% <0%> (ø) ⬆️
stix2/test/v20/test_granular_markings.py 100% <0%> (ø) ⬆️
stix2/test/v20/test_malware.py 100% <0%> (ø) ⬆️
stix2/test/v20/test_report.py 100% <0%> (ø) ⬆️
... and 59 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c96b742...f86b6e8. Read the comment docs.

Copy link
Contributor

@clenk clenk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Thanks, @chisholm.

@clenk clenk merged commit fdb00c4 into oasis-open:master Feb 13, 2020
@emmanvg emmanvg added this to the 1.3.1 milestone Feb 14, 2020
@chisholm chisholm deleted the improve_stix_version_detection branch February 25, 2020 22:06
@clenk clenk mentioned this pull request Mar 3, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

version arg is not passed down with the call to parse in STIXObjectProperty.clean
4 participants