Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AST comparison expression root type check for 'AND' is buggy #455

Closed
chisholm opened this issue Sep 15, 2020 · 0 comments · Fixed by #456
Closed

AST comparison expression root type check for 'AND' is buggy #455

chisholm opened this issue Sep 15, 2020 · 0 comments · Fixed by #456

Comments

@chisholm
Copy link
Contributor

For example,

[(type-a:a=1 OR type-b:b=2) AND (type-a:a=2 OR type-b:b=1)]

is okay, but

[type-a:a=1 AND (type-a:a=2 OR type-b:b=1)]

is not:

>>> stix2.pattern_visitor.create_pattern_object("[type-a:a=1 AND (type-a:a=2 OR type-b:b=1)]", version="2.1")

<start of long stacktrace omitted>

  File "C:\Programming\python\stix\cti-python-stix2\stix2\patterns.py", line 534, in __init__
    super(AndBooleanExpression, self).__init__("AND", operands)
  File "C:\Programming\python\stix\cti-python-stix2\stix2\patterns.py", line 514, in __init__
    raise ValueError("All operands to an 'AND' expression must have the same object type")
ValueError: All operands to an 'AND' expression must have the same object type

The latter pattern simply drops a disjunct from the first 'OR' from the first pattern. If the first is okay, the second should be too. Another example is:

[(type-a:a=1 OR type-a:b=2) AND (type-a:a=2 OR type-b:b=1)]

This one simply changes the type of the second comparison in the first 'OR' to 'type-a', so that both types in that 'OR' are the same. If the first example is okay, this one should be too.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant