From 268aa383e366a1254c507625b58dba80d7cebbed Mon Sep 17 00:00:00 2001 From: Arthur Muradyan Date: Tue, 26 Apr 2022 13:20:30 -0300 Subject: [PATCH] Fixed stix parsing with setvalue types (#907) --- .../stix_translation/src/utils/stix_pattern_parser.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/stix_shifter_utils/stix_translation/src/utils/stix_pattern_parser.py b/stix_shifter_utils/stix_translation/src/utils/stix_pattern_parser.py index 872c29630..f9dc5083d 100644 --- a/stix_shifter_utils/stix_translation/src/utils/stix_pattern_parser.py +++ b/stix_shifter_utils/stix_translation/src/utils/stix_pattern_parser.py @@ -1,5 +1,5 @@ from stix_shifter_utils.stix_translation.src.patterns.pattern_objects import ObservationExpression, ComparisonExpression, \ - ComparisonExpressionOperators, ComparisonComparators, Pattern, \ + ComparisonExpressionOperators, ComparisonComparators, Pattern, SetValue, \ CombinedComparisonExpression, CombinedObservationExpression, ObservationOperators import datetime from stix_shifter_utils.stix_translation.src.utils.transformers import DateTimeToUnixTimestamp @@ -27,6 +27,7 @@ class PatternTranslator: ComparisonComparators.IsSubSet: 'ISSUBSET' } + def __init__(self, pattern: Pattern, time_range): self.parsed_pattern = [] # Set times based on default time_range or what is in the options @@ -48,6 +49,10 @@ def _parse_expression(self, expression, qualifier=None) -> str: comparator = 'NOT ' + comparator if qualifier is not None: self._convert_qualifier_times_to_unix_times(qualifier) + + if (expression.comparator == ComparisonComparators.In and isinstance(expression.value, SetValue)): + expression.value = list(expression.value.element_iterator()) + self.parsed_pattern.append({'attribute': expression.object_path, 'comparison_operator': comparator, 'value': expression.value}) elif isinstance(expression, CombinedComparisonExpression): if qualifier is not None: