cti-python-stix2 icon indicating copy to clipboard operation
cti-python-stix2 copied to clipboard

TAXIICollectionSource should support 2.1 filters

Open clenk opened this issue 4 years ago • 3 comments

_parse_taxii_filters() doesn't support the TAXII 2.1-specific filters of limit, next, or spec_version.

See also: https://github.com/oasis-open/cti-taxii-client/issues/100.

clenk avatar Jun 22 '21 16:06 clenk

@zrush-mitre - is this something we need before we release python-stix2 3.0? (for 2.1)

rpiazza avatar Jul 07 '21 19:07 rpiazza

No rush to get this out with major release. I'll plan on working on this next week and hopefully submitting a PR.

zrush-mitre avatar Jul 08 '21 17:07 zrush-mitre

So a little update for this issue:

The 'limit' filter is not difficult to implement on TAXIICollectionSource, since there's only one or two functions that will actually go to call the TAXII server and they already have a paging functionality included, so replacing that with an argument for the 'limit' filter is pretty easy and immediately works well.

The problem comes from the 'next' filter: since 'next' only ever gets used after subsequent 'limit' responses, it doesn't really make sense for a user to explicitly give this value in the request, since paged requests will just return all of the objects collected with multiple requests to the server. However, a user may not actually want to receive all the returned objects with the 'limit' filter in the first place, and instead, the TAXIICollectionSource would need to either hold onto paged objects and only give them to the user when requested, or the functions would need to be refactored to not make all paged requests immediately.

I'm not sure what is the best way forward here, so this requires further investigation.

zrush-mitre avatar Aug 20 '21 13:08 zrush-mitre