def test_hex():
exp_and = stix2.AndBooleanExpression([stix2.EqualityComparisonExpression("file:mime_type",
"image/bmp"),
stix2.EqualityComparisonExpression("file:magic_number_hex",
stix2.HexConstant("ffd8"))])
exp = stix2.ObservationExpression(exp_and)
assert str(exp) == "[file:mime_type = 'image/bmp' AND file:magic_number_hex = h'ffd8']"
def visitTerminal(self, node):
if node.symbol.type == STIXPatternParser.IntLiteral:
return stix2.IntegerConstant(node.getText())
elif node.symbol.type == STIXPatternParser.FloatLiteral:
return stix2.FloatConstant(node.getText())
elif node.symbol.type == STIXPatternParser.HexLiteral:
return stix2.HexConstant(node.getText())
elif node.symbol.type == STIXPatternParser.BinaryLiteral:
return stix2.BinaryConstant(node.getText())
elif node.symbol.type == STIXPatternParser.StringLiteral:
return stix2.StringConstant(node.getText().strip('\''))
elif node.symbol.type == STIXPatternParser.BoolLiteral:
return stix2.BooleanConstant(node.getText())
elif node.symbol.type == STIXPatternParser.TimestampLiteral:
return stix2.TimestampConstant(node.getText())
# TODO: timestamp
else:
return node
def test_invalid_hex_constant():
with pytest.raises(ValueError):
stix2.HexConstant('mm')
def test_invalid_hex_constant():
with pytest.raises(ValueError) as excinfo:
stix2.HexConstant('mm')
assert "must contain an even number of hexadecimal characters" in str(excinfo)
