cti-python-stix2

cti-python-stix2 copied to clipboard

For some reason string '682' is treated as a year during serialisation and pattern with invalid syntax is produced:

In [3]: str(stix2.AndObservationExpression([
   ...:     stix2.EqualityComparisonExpression(stix2.ObjectPath('cve', ['value']), '2018-11790'),
   ...:     stix2.EqualityComparisonExpression(stix2.ObjectPath('cwe', ['value']), '682')]))
Out[3]: "cve:value = '2018-11790' AND cwe:value = 0682-02-28 00:00:00+00:00"

stix2 lib version I'm using is 1.1.1

simpler example:

In [3]: str(stix2.EqualityComparisonExpression(stix2.ObjectPath('port', ['value']), '1112'))
Out[3]: 'port:value = 1112-02-28 00:00:00+00:00'

it is happening not only for numbers, I see some IPv4 addresses being converted into datetime string as well

this is the cause - https://github.com/oasis-open/cti-python-stix2/blob/ba2f63f745167ba9919b5a7ef1636460b8ab950d/stix2/patterns.py#L229

A quick fix it to create the constant object before passing it in. Something like:

stix2.EqualityComparisonExpression(stix2.ObjectPath('cve', ['value']), String_Constant('2018-11790')),

See also this comment. As you noted, that function is basically written to assume everything is a datetime unless proven otherwise.