search

oasis-open / cti-stix-validator

OASIS TC Open Repository: Validator for STIX 2.0 JSON normative requirements and best practices
https://stix2-validator.readthedocs.io/
BSD 3-Clause "New" or "Revised" License
50 stars 41 forks source link

stix2_validator.py doesn't work with examples found on https://oasis-open.github.io/cti-documentation/stix/examples.html #159

Closed kudrew closed 3 years ago

kudrew commented 3 years ago

Running the sample stix2.1 reports found here fails using https://github.com/oasis-open/cti-stix-validator/blob/master/stix2validator/scripts/stix2_validator.py:

Outputs:

stix2_validator.py apt1.json
================================================================================
[-] Results for: apt1.json
[X] STIX JSON: Invalid
    [X] Fatal Error: 'charmap' codec can't decode byte 0x9d in position 15181: character maps to <undefined>
stix2_validator.py poisonivy.json
================================================================================
[-] Results for: poisonivy.json
[X] STIX JSON: Invalid
    [!] Warning: malware--591f0cb7-d66f-4e14-a8e6-5927b597f920: {101} Custom property 'is_family' should have a type that starts with 'x_' followed by a source unique identifier (like a domain name with dots replaced by hyphen), a hyphen and then the name.
    [!] Warning: malware--591f0cb7-d66f-4e14-a8e6-5927b597f920: {101} Custom property 'spec_version' should have a type that starts with 'x_' followed by a source unique identifier (like a domain name with dots replaced by hyphen), a hyphen and then the name.
    [!] Warning: malware--591f0cb7-d66f-4e14-a8e6-5927b597f920: {101} Custom property 'malware_types' should have a type that starts with 'x_' followed by a source unique identifier (like a domain name with dots replaced by hyphen), a hyphen and then the name.
    [!] Warning: identity--81cade27-7df8-4730-836b-62d880e6d9d3: {101} Custom property 'spec_version' should have a type that starts with 'x_' followed by a source unique identifier (like a domain name with dots replaced by hyphen), a hyphen and then the name.
    [!] Warning: campaign--752c225d-d6f6-4456-9130-d9580fd4007b: {101} Custom property 'spec_version' should have a type that starts with 'x_' followed by a source unique identifier (like a domain name with dots replaced by hyphen), a hyphen and then the name.
    [!] Warning: campaign--d02a1560-ff69-49f4-ac34-919b8aa4b91e: {101} Custom property 'spec_version' should have a type that starts with 'x_' followed by a source unique identifier (like a domain name with dots replaced by hyphen), a hyphen and then the name.
    [!] Warning: campaign--721976f9-56d7-4749-8c69-b3ac7c315f05: {101} Custom property 'spec_version' should have a type that starts with 'x_' followed by a source unique identifier (like a domain name with dots replaced by hyphen), a hyphen and then the name.
    [!] Warning: attack-pattern--19da6e1c-69a8-4c2f-886d-d620d09d3b5a: {101} Custom property 'spec_version' should have a type that starts with 'x_' followed by a source unique identifier (like a domain name with dots replaced by hyphen), a hyphen and then the name.

etc..

kudrew commented 3 years ago

was running an older version of the library (v1.1.2) vs v2.0.2