def normalize_to_xml(value, delimiter):
if not delimiter:
raise ValueError("delimiter must not be None")
if isinstance(value, list):
normalized_list = [six.text_type(x) for x in value]
if any(delimiter in x for x in normalized_list):
raise ValueError("list items cannot contain delimiter")
normalized = delimiter.join(normalized_list)
else:
normalized = six.text_type(value)
if delimiter in normalized:
raise ValueError("value cannot contain delimiter")
return normalized
def test_identity_from_xml(self):
obj = self.klass.from_dict(self._full_dict)
sp = STIXPackage()
sp.add(obj)
s = BytesIO(sp.to_xml())
pkg = STIXPackage.from_xml(s)
self.assertTrue("CIQIdentity3.0InstanceType" in text_type(pkg.to_xml()))
def test_add_name_type(self):
maec_malware_instance = MAECInstance()
maec_malware_instance.add_name("Poison Ivy Variant v4392-acc")
maec_malware_instance.add_type("Remote Access Trojan")
maec_xml = text_type(maec_malware_instance.to_xml())
self.assertTrue("Poison Ivy Variant v4392-acc" in maec_xml)
self.assertTrue("Remote Access Trojan" in maec_xml)
def test_add_name_type(self):
maec_malware_instance = MAECInstance()
maec_malware_instance.add_name("Poison Ivy Variant v4392-acc")
maec_malware_instance.add_type("Remote Access Trojan")
maec_xml = text_type(maec_malware_instance.to_xml())
self.assertTrue("Poison Ivy Variant v4392-acc" in maec_xml)
self.assertTrue("Remote Access Trojan" in maec_xml)
def test_unicode_string(self):
s = u("A Unicode \ufffd string")
string = String(s)
unicode_string = six.text_type(string)
self.assertEqual(s, unicode_string)
self.assertEqual(s.encode("utf-8"), unicode_string.encode("utf-8"))
self.assertTrue(s.encode("utf-8") in string.to_xml())
def test_datetime_format(self):
indicator = Indicator(title="title")
valid_time = ValidTime(
start_time=datetime.strptime("2010-03-05", "%Y-%m-%d"))
indicator.add_valid_time_position(valid_time)
ixml = indicator.to_xml()
self.assertTrue("2010-03-05T" in text_type(ixml))
def test_unicode_string(self):
s = u("A Unicode \ufffd string")
string = String(s)
unicode_string = six.text_type(string)
self.assertEqual(s, unicode_string)
self.assertEqual(s.encode("utf-8"), unicode_string.encode("utf-8"))
self.assertTrue(s.encode("utf-8") in string.to_xml())
def test_datetime_format(self):
indicator = Indicator(title="title")
valid_time = ValidTime(start_time=datetime.strptime("2010-03-05",
"%Y-%m-%d"))
indicator.add_valid_time_position(valid_time)
ixml = indicator.to_xml()
self.assertTrue("2010-03-05T" in text_type(ixml))
def from_dict(cls, cls_dict):
if not cls_dict:
return None
artifact = super(Artifact, cls).from_dict(cls_dict)
raw_artifact = cls_dict.get('raw_artifact')
if raw_artifact:
artifact.raw_artifact = RawArtifact.from_dict(raw_artifact)
artifact.packed_data = six.text_type(artifact.raw_artifact.value)
return artifact
def from_obj(cls, cls_obj):
if not cls_obj:
return None
artifact = super(Artifact, cls).from_obj(cls_obj)
raw_artifact = cls_obj.Raw_Artifact
if raw_artifact:
artifact.raw_artifact = RawArtifact.from_obj(raw_artifact)
artifact.packed_data = six.text_type(artifact.raw_artifact.value)
return artifact
def from_dict(cls, cls_dict):
if not cls_dict:
return None
artifact = super(Artifact, cls).from_dict(cls_dict)
for layer in cls_dict.get('packaging', []):
if layer.get('packaging_type') == "compression":
artifact.packaging.append(CompressionFactory.from_dict(layer))
if layer.get('packaging_type') == "encryption":
artifact.packaging.append(EncryptionFactory.from_dict(layer))
if layer.get('packaging_type') == "encoding":
artifact.packaging.append(EncodingFactory.from_dict(layer))
raw_artifact = cls_dict.get('raw_artifact')
if raw_artifact:
artifact.raw_artifact = RawArtifact.from_dict(raw_artifact)
artifact.packed_data = six.text_type(artifact.raw_artifact.value)
return artifact
def from_dict(cls, cls_dict):
if not cls_dict:
return None
artifact = super(Artifact, cls).from_dict(cls_dict)
for layer in cls_dict.get('packaging', []):
if layer.get('packaging_type') == "compression":
artifact.packaging.append(CompressionFactory.from_dict(layer))
if layer.get('packaging_type') == "encryption":
artifact.packaging.append(EncryptionFactory.from_dict(layer))
if layer.get('packaging_type') == "encoding":
artifact.packaging.append(EncodingFactory.from_dict(layer))
raw_artifact = cls_dict.get('raw_artifact')
if raw_artifact:
artifact.raw_artifact = RawArtifact.from_dict(raw_artifact)
artifact.packed_data = six.text_type(artifact.raw_artifact.value)
return artifact
def from_obj(cls, cls_obj):
if not cls_obj:
return None
artifact = super(Artifact, cls).from_obj(cls_obj)
packaging = cls_obj.Packaging
if packaging:
for c in packaging.Compression:
artifact.packaging.append(CompressionFactory.from_obj(c))
for e in packaging.Encryption:
artifact.packaging.append(EncryptionFactory.from_obj(e))
for e in packaging.Encoding:
artifact.packaging.append(EncodingFactory.from_obj(e))
raw_artifact = cls_obj.Raw_Artifact
if raw_artifact:
artifact.raw_artifact = RawArtifact.from_obj(raw_artifact)
artifact.packed_data = six.text_type(artifact.raw_artifact.value)
return artifact
def from_obj(cls, cls_obj):
if not cls_obj:
return None
artifact = super(Artifact, cls).from_obj(cls_obj)
packaging = cls_obj.Packaging
if packaging:
for c in packaging.Compression:
artifact.packaging.append(CompressionFactory.from_obj(c))
for e in packaging.Encryption:
artifact.packaging.append(EncryptionFactory.from_obj(e))
for e in packaging.Encoding:
artifact.packaging.append(EncodingFactory.from_obj(e))
raw_artifact = cls_obj.Raw_Artifact
if raw_artifact:
artifact.raw_artifact = RawArtifact.from_obj(raw_artifact)
artifact.packed_data = six.text_type(artifact.raw_artifact.value)
return artifact
def from_dict(artifact_dict):
if not artifact_dict:
return None
artifact = Artifact()
ObjectProperties.from_dict(artifact_dict, artifact)
for layer in artifact_dict.get('packaging', []):
if layer.get('packaging_type') == "compression":
artifact.packaging.append(Compression.from_dict(layer))
if layer.get('packaging_type') == "encryption":
artifact.packaging.append(Encryption.from_dict(layer))
if layer.get('packaging_type') == "encoding":
artifact.packaging.append(Encoding.from_dict(layer))
raw_artifact = artifact_dict.get('raw_artifact')
if raw_artifact:
data = RawArtifact.from_dict(raw_artifact).value
artifact.packed_data = six.text_type(data)
artifact.type_ = artifact_dict.get('type')
return artifact
def from_obj(artifact_obj):
if not artifact_obj:
return None
artifact = Artifact()
ObjectProperties.from_obj(artifact_obj, artifact)
packaging = artifact_obj.Packaging
if packaging:
for c in packaging.Compression:
artifact.packaging.append(Compression.from_obj(c))
for e in packaging.Encryption:
artifact.packaging.append(Encryption.from_obj(e))
for e in packaging.Encoding:
artifact.packaging.append(Encoding.from_obj(e))
raw_artifact = artifact_obj.Raw_Artifact
if raw_artifact:
data = RawArtifact.from_obj(raw_artifact).value
artifact.packed_data = six.text_type(data)
artifact.type_ = artifact_obj.type_
return artifact
def __str__(self):
return six.text_type(self.address_value)
def __unicode__(self):
"""Returns a ``unicode`` string representation of the ``value``.
"""
return text_type(self.value)
def test_quote_xml_bool(self):
b = True
s = quote_xml(b)
self.assertEqual(six.text_type(b), s)
# Copyright (c) 2017, The MITRE Corporation. All rights reserved.
# See LICENSE.txt for complete terms.
import binascii
import unittest
from mixbox.vendor import six
from mixbox.vendor.six import u
from cybox.common import ExtractedString, Hash
from cybox.test import EntityTestCase
STRING = u("This is a string")
HEX_STRING = six.text_type(binascii.hexlify(STRING.encode("ascii")))
class TestExtractedString(EntityTestCase, unittest.TestCase):
klass = ExtractedString
_full_dict = {
'encoding': u("UTF-8"),
'string_value': STRING,
'byte_string_value': HEX_STRING,
'hashes': [{
'type': Hash.TYPE_MD5
}],
'address': u("1a2b"),
'length': len(STRING),
'language': u("English"),
'english_translation': STRING,
}
def test_parse_datetime(self):
cybox_dt = DateTime(self.dt)
self.assertEqual(self.dt, cybox_dt.value)
self.assertEqual(self.dt.isoformat(), six.text_type(cybox_dt))
def __unicode__(self):
"""Returns a ``unicode`` string representation of the ``value``.
"""
return text_type(self.value)
# Copyright (c) 2017, The MITRE Corporation. All rights reserved.
# See LICENSE.txt for complete terms.
import binascii
import unittest
from mixbox.vendor import six
from mixbox.vendor.six import u
from cybox.common import ExtractedString, Hash
from cybox.test import EntityTestCase
STRING = u("This is a string")
HEX_STRING = six.text_type(binascii.hexlify(STRING.encode("ascii")))
class TestExtractedString(EntityTestCase, unittest.TestCase):
klass = ExtractedString
_full_dict = {
'encoding': u("UTF-8"),
'string_value': STRING,
'byte_string_value': HEX_STRING,
'hashes': [{'type': Hash.TYPE_MD5}],
'address': u("1a2b"),
'length': len(STRING),
'language': u("English"),
'english_translation': STRING,
}
if __name__ == "__main__":
def value(self, value):
self._value = six.text_type(value)
def __unicode__(self):
return text_type(self.value)
def __str__(self):
return six.text_type(self.serialized_value)
def test_quote_xml_zero(self):
i = 0
s = quote_xml(i)
self.assertEqual(six.text_type(i), s)
def test_unicode(self):
text = self.klass.from_dict(self._full_dict)
# This should not raise any errors
self.assertTrue(b"WARNING" in text_type(text).encode('utf-8'))
def test_coerce_to_string(self):
val = "abc1234"
s = String(val)
self.assertEqual(val, s.value)
self.assertEqual(val, six.text_type(s))
def __str__(self):
return six.text_type(self.serialized_value)
def test_parse_date_string(self):
cybox_dt2 = DateTime(self.dt_str)
self.assertEqual(self.dt, cybox_dt2.value)
self.assertEqual(self.dt.isoformat(), cybox_dt2.serialized_value)
self.assertEqual(self.dt.isoformat(), six.text_type(cybox_dt2))
def test_unicode_split(self):
nm = NMTokens([u"This", u"is", u"a", u"test"])
self.assertEquals(u"This is a test", text_type(nm))
def to_xml(self, include_namespaces=True, include_schemalocs=False,
ns_dict=None, schemaloc_dict=None, pretty=True,
auto_namespace=True, encoding='utf-8'):
"""Serializes a :class:`Entity` instance to an XML string.
The default character encoding is ``utf-8`` and can be set via the
`encoding` parameter. If `encoding` is ``None``, a string (unicode in
Python 2, str in Python 3) is returned.
Args:
auto_namespace: Automatically discover and export XML namespaces
for a STIX :class:`Entity` instance.
include_namespaces: Export namespace definitions in the output
XML. Default is ``True``.
include_schemalocs: Export ``xsi:schemaLocation`` attribute
in the output document. This will attempt to associate
namespaces declared in the STIX document with schema locations.
If a namespace cannot be resolved to a schemaLocation, a
Python warning will be raised. Schemalocations will only be
exported if `include_namespaces` is also ``True``.
ns_dict: Dictionary of XML definitions (namespace is key, alias is
value) to include in the exported document. This must be
passed in if `auto_namespace` is ``False``.
schemaloc_dict: Dictionary of XML ``namespace: schema location``
mappings to include in the exported document. These will
only be included if `auto_namespace` is ``False``.
pretty: Pretty-print the XML.
encoding: The output character encoding. Default is ``utf-8``. If
`encoding` is set to ``None``, a string (unicode in Python 2,
str in Python 3) is returned.
Returns:
An XML string for this
:class:`Entity` instance. Default character encoding is ``utf-8``.
"""
from .utils import nsparser
parser = nsparser.NamespaceParser()
if auto_namespace:
ns_info = nsparser.NamespaceInfo()
else:
ns_info = None
obj = self.to_obj(ns_info=ns_info)
if (not auto_namespace) and (not ns_dict):
raise Exception(
"Auto-namespacing was disabled but ns_dict was empty "
"or missing."
)
if auto_namespace:
ns_info.finalize(ns_dict=ns_dict, schemaloc_dict=schemaloc_dict)
obj_ns_dict = ns_info.binding_namespaces
else:
ns_info = nsparser.NamespaceInfo()
ns_info.finalized_namespaces = ns_dict or {}
ns_info.finalized_schemalocs = schemaloc_dict or {}
obj_ns_dict = dict(
itertools.chain(
iteritems(ns_dict),
iteritems(nsparser.DEFAULT_STIX_NAMESPACES)
)
)
namespace_def = ""
if include_namespaces:
xmlns = parser.get_xmlns_str(ns_info.finalized_namespaces)
namespace_def += ("\n\t" + xmlns)
if include_schemalocs and include_namespaces:
schemaloc = parser.get_schemaloc_str(ns_info.finalized_schemalocs)
namespace_def += ("\n\t" + schemaloc)
if not pretty:
namespace_def = namespace_def.replace('\n\t', ' ')
with save_encoding(encoding):
sio = StringIO()
obj.export(
sio.write, # output buffer
0, # output level
obj_ns_dict, # namespace dictionary
pretty_print=pretty, # pretty printing
namespacedef_=namespace_def # namespace/schemaloc def string
)
# Ensure that the StringIO buffer is unicode
s = text_type(sio.getvalue())
if encoding:
return s.encode(encoding)
return s
def to_xml(self,
include_namespaces=True,
include_schemalocs=False,
ns_dict=None,
schemaloc_dict=None,
pretty=True,
auto_namespace=True,
encoding='utf-8'):
"""Serializes a :class:`Entity` instance to an XML string.
The default character encoding is ``utf-8`` and can be set via the
`encoding` parameter. If `encoding` is ``None``, a string (unicode in
Python 2, str in Python 3) is returned.
Args:
auto_namespace: Automatically discover and export XML namespaces
for a STIX :class:`Entity` instance.
include_namespaces: Export namespace definitions in the output
XML. Default is ``True``.
include_schemalocs: Export ``xsi:schemaLocation`` attribute
in the output document. This will attempt to associate
namespaces declared in the STIX document with schema locations.
If a namespace cannot be resolved to a schemaLocation, a
Python warning will be raised. Schemalocations will only be
exported if `include_namespaces` is also ``True``.
ns_dict: Dictionary of XML definitions (namespace is key, alias is
value) to include in the exported document. This must be
passed in if `auto_namespace` is ``False``.
schemaloc_dict: Dictionary of XML ``namespace: schema location``
mappings to include in the exported document. These will
only be included if `auto_namespace` is ``False``.
pretty: Pretty-print the XML.
encoding: The output character encoding. Default is ``utf-8``. If
`encoding` is set to ``None``, a string (unicode in Python 2,
str in Python 3) is returned.
Returns:
An XML string for this
:class:`Entity` instance. Default character encoding is ``utf-8``.
"""
from mixbox.entities import NamespaceCollector
if (not auto_namespace) and (not ns_dict):
raise Exception(
"Auto-namespacing was disabled but ns_dict was empty "
"or missing.")
ns_info = NamespaceCollector()
obj = self.to_obj(ns_info=ns_info if auto_namespace else None)
ns_info.finalize(ns_dict=ns_dict, schemaloc_dict=schemaloc_dict)
if auto_namespace:
obj_ns_dict = ns_info.binding_namespaces
else:
obj_ns_dict = dict(
itertools.chain(iteritems(ns_info.binding_namespaces),
iteritems(namespaces.get_full_ns_map())))
namespace_def = ""
if include_namespaces:
delim = "\n\t" if pretty else " "
xmlns = ns_info.get_xmlns_string(delim)
namespace_def += (delim + xmlns)
if include_schemalocs:
schemaloc = ns_info.get_schema_location_string(delim)
namespace_def += (delim + schemaloc)
with binding_utils.save_encoding(encoding):
sio = StringIO()
obj.export(
sio.write, # output buffer
0, # output level
obj_ns_dict, # namespace dictionary
pretty_print=pretty, # pretty printing
namespacedef_=namespace_def # namespace/schemaloc def string
)
# Ensure that the StringIO buffer is unicode
s = text_type(sio.getvalue())
if encoding:
return s.encode(encoding)
return s
def value(self, value):
self._value = six.text_type(value)
def test_quote_xml_int(self):
i = 65536
s = quote_xml(i)
self.assertEqual(six.text_type(i), s)
def __str__(self):
return six.text_type(self.value)
def test_coerce_to_string(self):
val = "abc1234"
s = String(val)
self.assertEqual(val, s.value)
self.assertEqual(val, six.text_type(s))
def __str__(self):
return six.text_type(self.address_value)
def test_parse_datetime(self):
cybox_dt = DateTime(self.dt)
self.assertEqual(self.dt, cybox_dt.value)
self.assertEqual(self.dt.isoformat(), six.text_type(cybox_dt))
def __unicode__(self):
return text_type(self.value)
def test_parse_date_string(self):
cybox_dt2 = DateTime(self.dt_str)
self.assertEqual(self.dt, cybox_dt2.value)
self.assertEqual(self.dt.isoformat(), cybox_dt2.serialized_value)
self.assertEqual(self.dt.isoformat(), six.text_type(cybox_dt2))
