oasis-open / cti-pattern-validator

OASIS TC Open Repository: Validate patterns used to express cyber observable content in STIX Indicators
https://stix2-patterns.readthedocs.io/
BSD 3-Clause "New" or "Revised" License
26 stars 23 forks source link

Brackets check doesn't account for arbitrary nested parentheses #80

Closed chisholm closed 4 years ago

chisholm commented 4 years ago

There is code to add a simpler error message in one particular case: when the user has forgotten square brackets around the pattern. But it is too specific: it requires that patterns start with either [ or ([:

https://github.com/oasis-open/cti-pattern-validator/blob/2dafa44d3ea37faefaaa92e703f2ac481485de31/stix2patterns/v21/validator.py#L98

Patterns can have arbitrarily nested structure, so the pattern can start with an arbitrary number of open parentheses. The check needs to be generalized.