oasis-open / cti-pattern-validator

OASIS TC Open Repository: Validate patterns used to express cyber observable content in STIX Indicators
https://stix2-patterns.readthedocs.io/
BSD 3-Clause "New" or "Revised" License
26 stars 23 forks source link

Multi qualifier #71

Closed clenk closed 4 years ago

clenk commented 4 years ago

In working to fix this we found that the spec was ambiguous: https://github.com/oasis-tcs/cti-stix2/issues/214. However, since consensus in the CTI TC hasn't been reached on this for STIX 2.1, we're interpreting the restriction on multiple qualifiers to only apply to qualifiers applied directly to an observation expression. This means the restriction can be bypassed by adding parentheses, but I think it's better in this case to allow patterns that should be valid than to prevent users from doing something nonsensical. Hopefully the situation will improve with STIX 2.2.

Fixes #66.