def __parse_email_message(self, msg): """ Parses the supplied message Returns a map of message parts expressed as cybox objects. Keys: 'message', 'files', 'urls' """ files = [] url_list = [] domain_list = [] message = EmailMessage() # Headers are required (for now) message.header = self.__create_cybox_headers(msg) if self.include_attachments: files = self.__create_cybox_files(msg) message.attachments = Attachments() for f in files: message.attachments.append(f.parent.id_) f.add_related(message, "Contained_Within", inline=False) if self.include_raw_headers: raw_headers_str = self.__get_raw_headers(msg).strip() if raw_headers_str: message.raw_header = String(raw_headers_str) # need this for parsing urls AND raw body text raw_body = "\n".join(self.__get_raw_body_text(msg)).strip() if self.include_raw_body and raw_body: message.raw_body = String(raw_body) if self.include_urls: (url_list, domain_list) = self.__parse_urls(raw_body) if url_list: links = Links() for u in url_list: links.append(LinkReference(u.parent.id_)) if links: message.links = links # Return a list of all objects we've built return [message] + files + url_list + domain_list
def test_round_trip_list(self): l = Links() l.append("example:URI-watchlist1") l.append("example:URI-watchlist2") l2 = cybox.test.round_trip(l, list_=True) self.assertEqual(l.to_list(), l2.to_list())