search

oasis-open / cti-python-stix2

OASIS TC Open Repository: Python APIs for STIX 2
https://stix2.readthedocs.io/
BSD 3-Clause "New" or "Revised" License
356 stars 113 forks source link

stix2 3.0.0 - Filter object doesn’t work properly #524

Closed ChanochShayner closed 2 years ago

ChanochShayner commented 2 years ago

For the previous version of stix2, this Filter returned the correct value of the Attack Pattern - attack_pattern_name = tc_source.query([ Filter("external_references.external_id", "=", attack_id), Filter("type", "=", "attack-pattern") ])[0]['name'] For the new version, the Filter always returns the same value - Code Signing Policy Modification

The code:

collection_id = f"stix/collections/{ENTERPRISE_COLLECTION_ID}/" collection_url = urljoin('https://cti-taxii.mitre.org', collection_id) collection_data = Collection(collection_url, verify=client.verify, proxies=client.proxies) tc_source = TAXIICollectionSource(collection_data) attack_pattern_name = tc_source.query([ Filter("external_references.external_id", "=", attack_id), Filter("type", "=", "attack-pattern") ])[0]['name']

chisholm commented 2 years ago

I have confirmed this bug. The reason you see the same value is because all attack patterns are erroneously being returned, so item 0 is always the same item, with the same name. I have opened issue #525.

ChanochShayner commented 2 years ago

@chisholm Thank you! Did the patch go into version 3.0.0? If not, is it possible to insert it? This is really important to me, thank you very much.

chisholm commented 2 years ago

We would not retroactively change version 3.0.0, we would release a new version. I think a new version would not be released until at least after Labor Day. I would also like to get PR #528 merged before then.