def test_hex(): exp_and = stix2.AndBooleanExpression([stix2.EqualityComparisonExpression("file:mime_type", "image/bmp"), stix2.EqualityComparisonExpression("file:magic_number_hex", stix2.HexConstant("ffd8"))]) exp = stix2.ObservationExpression(exp_and) assert str(exp) == "[file:mime_type = 'image/bmp' AND file:magic_number_hex = h'ffd8']"
def visitTerminal(self, node): if node.symbol.type == STIXPatternParser.IntLiteral: return stix2.IntegerConstant(node.getText()) elif node.symbol.type == STIXPatternParser.FloatLiteral: return stix2.FloatConstant(node.getText()) elif node.symbol.type == STIXPatternParser.HexLiteral: return stix2.HexConstant(node.getText()) elif node.symbol.type == STIXPatternParser.BinaryLiteral: return stix2.BinaryConstant(node.getText()) elif node.symbol.type == STIXPatternParser.StringLiteral: return stix2.StringConstant(node.getText().strip('\'')) elif node.symbol.type == STIXPatternParser.BoolLiteral: return stix2.BooleanConstant(node.getText()) elif node.symbol.type == STIXPatternParser.TimestampLiteral: return stix2.TimestampConstant(node.getText()) # TODO: timestamp else: return node
def test_invalid_hex_constant(): with pytest.raises(ValueError): stix2.HexConstant('mm')
def test_invalid_hex_constant(): with pytest.raises(ValueError) as excinfo: stix2.HexConstant('mm') assert "must contain an even number of hexadecimal characters" in str(excinfo)