Correct SSDEEP case for STIX 2.1

MANIFEST.in

@@ -9,4 +9,4 @@ include stix2patterns/test/v20/spec_examples.txt
 include stix2patterns/test/v21/spec_examples.txt
 
 recursive-include docs *
-prune docs/_build
+prune docs/_build

docs/Makefile

@@ -17,4 +17,4 @@ help:
 # Catch-all target: route all unknown targets to Sphinx using the new
 # "make mode" option. $(O) is meant as a shortcut for $(SPHINXOPTS).
 %: Makefile
- @$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
+ @$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)

docs/installation.rst

@@ -26,4 +26,4 @@ Using `pip <https://pip.pypa.io>`__ is highly recommended:
 
 For more information about installing Python packages, see the `Python
 Packaging User Guide
-<https://packaging.python.org/tutorials/installing-packages/>`__.
+<https://packaging.python.org/tutorials/installing-packages/>`__.

docs/usage.rst

@@ -46,4 +46,4 @@ File Input
 Use <path\_to\_file> to specify the path to a file containing a set of patterns
 to validate. Each pattern must be on a separate line of the file so that the
 validator may determine where the pattern begins and ends. The validator will
-supply the PASS/FAIL result of each pattern.
+supply the PASS/FAIL result of each pattern.

stix2patterns/test/v21/spec_examples.txt

@@ -20,4 +20,4 @@
 [process:command_line MATCHES '^.+>-add GlobalSign.cer -c -s -r localMachine Root$'] FOLLOWEDBY [process:command_line MATCHES'^.+>-add GlobalSign.cer -c -s -r localMachineTrustedPublisher$'] WITHIN 300 SECONDS
 [network-traffic:dst_ref.value ISSUBSET '2001:0db8:dead:beef:0000:0000:0000:0000/64']
 ([file:name = 'foo.dll'] AND [win-registry-key:key = 'HKEY_LOCAL_MACHINE\\foo\\bar']) OR [process:name = 'fooproc' OR process:name = 'procfoo']
-[file:hashes.MD5 = 'cead3f77f6cda6ec00f57d76c9a69faa']
+[file:hashes.MD5 = 'cead3f77f6cda6ec00f57d76c9a69faa']

stix2patterns/v20/object_validator.py

@@ -21,6 +21,7 @@
 
 def verify_object(patt_data):
  error_list = []
+ msg = "FAIL: '{}' is not a valid {} hash"
 
  # iterate over observed objects
  for type_name, comp in patt_data.comparisons.items():
@@ -31,7 +32,7 @@ def verify_object(patt_data):
  hash_string = str(expression[2].replace("\'", ""))
  if hash_type in HASHES_REGEX:
  if not re.match(HASHES_REGEX[hash_type][0], hash_string):
- error_list.append("FAIL: '{0}' is not a valid {1} "
-  "hash".format(hash_string,
-  expression[0][-1]))
+ error_list.append(
+ msg.format(hash_string, expression[0][-1])
+ )
  return error_list

stix2patterns/v21/object_validator.py

@@ -14,13 +14,14 @@
  "SHA3256": (r"^[a-fA-F0-9]{64}$", "SHA3-256"),
  "SHA3384": (r"^[a-fA-F0-9]{96}$", "SHA3-384"),
  "SHA3512": (r"^[a-fA-F0-9]{128}$", "SHA3-512"),
- "SSDEEP": (r"^[a-zA-Z0-9/+:.]{1,128}$", "ssdeep"),
+ "SSDEEP": (r"^[a-zA-Z0-9/+:.]{1,128}$", "SSDEEP"),
  "WHIRLPOOL": (r"^[a-fA-F0-9]{128}$", "WHIRLPOOL"),
 }
 
 
 def verify_object(patt_data):
  error_list = []
+ msg = "FAIL: '{}' is not a valid {} hash"
 
  # iterate over observed objects
  for type_name, comp in patt_data.comparisons.items():
@@ -31,7 +32,7 @@ def verify_object(patt_data):
  hash_string = str(expression[2].replace("\'", ""))
  if hash_type in HASHES_REGEX:
  if not re.match(HASHES_REGEX[hash_type][0], hash_string):
- error_list.append("FAIL: '{0}' is not a valid {1} "
-  "hash".format(hash_string,
-  expression[0][-1]))
+ error_list.append(
+ msg.format(hash_string, expression[0][-1])
+ )
  return error_list