search

muchdogesec / stix2arango

stix2arango is a command line tool that takes a group of STIX 2.1 objects in a bundle and inserts them into ArangoDB. It can also handle updates to existing objects in ArangoDB imported in a bundle.
GNU Affero General Public License v3.0
1 stars 0 forks source link

Script does not create embedded relationships for nested ref or refs properties #13

Closed himynamesdave closed 2 weeks ago

himynamesdave commented 3 weeks ago

When embedded refs are nested, e.g. address_ref they are ignored.

{
    "type": "bundle",
    "id": "bundle--7985964e-a029-410a-98d8-a1bcd67ef32d",
    "objects": [
        {
            "type": "cryptocurrency-transaction",
            "spec_version": "2.1",
            "id": "cryptocurrency-transaction--f437c493-b651-5cbb-845a-3dd231a39ec6",
            "symbol": "BTC",
            "hash": "cfb39d98f66da8bfe42ad86894f116a3c1d8c6d1189456fcffae615a80623c49",
            "execution_time": "2020-04-25T18:24:13Z",
            "output": [
                {
                    "address_ref": "cryptocurrency-wallet--d3efcf4e-d9fa-578d-a83f-f11af4c2504c",
                    "amount": 43577930
                },
                {
                    "address_ref": "cryptocurrency-wallet--f17481a9-a6ad-5ebc-af2a-9b637dab774b",
                    "amount": 2723995
                },
                {
                    "address_ref": "cryptocurrency-wallet--9edba811-a14c-5795-8dd6-e39b4bde1c40",
                    "amount": 2723995
                },
                {
                    "address_ref": "cryptocurrency-wallet--7052df7c-e9f4-5fc9-bc57-304278647176",
                    "amount": 5448090
                }
            ],
            "object_marking_refs": [
                "marking-definition--904ac99b-7539-5de7-9ffa-23186f0e07b6",
                "marking-definition--27557362-b745-4161-96e8-ccd62ce4cb26",
                "marking-definition--94868c89-83c2-464b-929b-a1a8aa3c8487"
            ],
            "extensions": {
                "extension-definition--151d042d-4dcf-5e44-843f-1024440318e5": {
                    "extension_type": "new-sco"
                }
            }
        }
    ]
}

Covered in test 18:

https://github.com/muchdogesec/stix2arango/tree/fix-nested-embedded-refs

======================================================================
FAIL: test_query_1 (tests.test_18-testing-nested-embedded-ref.TestArangoDBQueries)
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/Users/dgreenwood/Documents/repos/dogesec/stix2arango/tests/test_18-testing-nested-embedded-ref.py", line 33, in test_query_1
    self.assertEqual(result['result'], expected_result)
AssertionError: Lists differ: [3] != [7]

First differing element 0:
3
7

- [3]
+ [7]

----------------------------------------------------------------------
Ran 1 test in 1.936s

FAILED (failures=1)

expected, script creates embedded relationships for ref or refs properties up to 2 levels deep