def test_greater_than():
exp1 = stix2.GreaterThanComparisonExpression(
"file:extensions.'windows-pebinary-ext'.sections[*].entropy",
stix2.FloatConstant(7.0),
)
exp = stix2.ObservationExpression(exp1)
assert str(exp) == "[file:extensions.'windows-pebinary-ext'.sections[*].entropy > 7.0]"
def visitTerminal(self, node):
if node.symbol.type == STIXPatternParser.IntLiteral:
return stix2.IntegerConstant(node.getText())
elif node.symbol.type == STIXPatternParser.FloatLiteral:
return stix2.FloatConstant(node.getText())
elif node.symbol.type == STIXPatternParser.HexLiteral:
return stix2.HexConstant(node.getText())
elif node.symbol.type == STIXPatternParser.BinaryLiteral:
return stix2.BinaryConstant(node.getText())
elif node.symbol.type == STIXPatternParser.StringLiteral:
return stix2.StringConstant(node.getText().strip('\''))
elif node.symbol.type == STIXPatternParser.BoolLiteral:
return stix2.BooleanConstant(node.getText())
elif node.symbol.type == STIXPatternParser.TimestampLiteral:
return stix2.TimestampConstant(node.getText())
# TODO: timestamp
else:
return node
def test_invalid_float_constant():
with pytest.raises(ValueError):
stix2.FloatConstant('foo')
def test_invalid_float_constant():
with pytest.raises(ValueError) as excinfo:
stix2.FloatConstant('foo')
assert 'must be a float' in str(excinfo)
