search

oasis-open / cti-stix-common-objects

OASIS Cyber Threat Intelligence (CTI) TC: A repository for commonly used STIX objects in order to avoid needless duplication. https://github.com/oasis-open/cti-stix-common-objects
BSD 3-Clause "New" or "Revised" License
86 stars 38 forks source link

malware-behavior $refs URLs point to /malware-behavior/ instead of /malware-behavior-8e9/ #80

Open dunkeki opened 1 week ago

dunkeki commented 1 week ago

Don't know if these have been fixed by Charles et al, but they're broken in cti-stix-common-objects/extension-definition-specifications/malware-behavior-8e9/ ... thanks!

dunkeki commented 1 week ago

Part of the problem is that these are absolute URLs - the problem wouldn't be so profound if they were relative refs...

rpiazza commented 1 week ago

@dunkeki - I made the changes to add 8e9 to the urls that were missing it. It is on the malware-behavior-8e9 branch. Please test it. If it is ok I will merge it in.

dunkeki commented 1 week ago

Missed one in extension-definition--8e9e338f-c9ee-4d4f-8cac-85b4dcfdf3c1.json, thanks.

rpiazza commented 1 week ago

Done

dunkeki commented 1 week ago

Since the $ref URLs are absolute to raw GitHub, I can't test. Things are probably correct (well, the current version is broken so merging what is probably correct is a good thing). Can you please merge? Thanks.

If you know a way around this without merging, let me know...

dunkeki commented 1 week ago

Those $ref should be relative. Then my local copy (which is corrected by you, thanks) would be used and work :(

dunkeki commented 1 week ago

If you'd like, I can fix my local copy, get it working (AFAIK), and then post a tarball back to here...

rpiazza commented 1 week ago

I'm not 100% sure why absolute urls were used, if it was necessary. Let me do the merge, then you can experiment.

dunkeki commented 1 week ago

malware-behavior-8e9.TGZ

In addition to relativizing the $ref, there were a number of JSON errors in examples/behavior-unprotect.json (e.g. extra commas on a last array element, etc.). That file has been fixed as well (even though it won't pass schema validation - as intended - but the schema still work referencing each other etc.)

Thanks!