casework / CASE

Cyber-investigation Analysis Standard Expression (CASE) Ontology
https://caseontology.org
Apache License 2.0
67 stars 22 forks source link

message.json - url is the only valid property of the Attachment property bundle #15

Open vikhari opened 6 years ago

vikhari commented 6 years ago

Issue ported from old casework github repo (issue 26). Original author: sbarnum

In the example, two of the Relationship objects near the end have Attachment property bundles specifying mimeType and sizeInBytes properties. These properties are not valid on the Attachment property bundle. The Attachment property bundle only has a single valid property, 'url'.

The mimeType and sizeInBytes properties should be expressed using a ContentData property bundle on the attachment_file1 and attachment_file2 objects.

vikhari commented 6 years ago

Reply by casework:

The mimeType and sizeInBytes in the Attachment property bundle is part of the message artifact. Applications usually like to store information about an attachment in it's database. This information can conflict with the data of the actual file. (rounded up size, non-standard mimeType, etc)

As well, properties of ContentData should only contain information parsed from the data itself, not from a separate database.

I believe the Attachment functionality may need to be reworked.

vikhari commented 6 years ago

Reply by sbarnum:

I agree that we should revisit the way that attachments of messages are conveyed.

For now (v0.1.0) though, the Attachment property bundle has only one valid property, 'url' so the example should not include the other properties.

vikhari commented 6 years ago

Reply by casework:

Sounds good.

53b45e6 (commit link)