NoneType object has no attribute 'keys'

[arcsector]

In a little test script I'm working on, I'm using the elevator to elevate a stix1 package. I have already validated it using the stix1validator, but it is giving a weird error:

[stixmarx.fields] [INFO   ] [2019-04-22 19:56:38,257] No compatible stix 1.2.0.6 mappings found. Loaded latest unchanged 1.2.0.5 field mappings.
No compatible stix 1.2.0.6 mappings found. Loaded latest unchanged 1.2.0.5 field mappings.
[stixmarx.fields] [INFO   ] [2019-04-22 19:56:38,264] No compatible cybox 2.1.0.17 mappings found. Loaded latest unchanged 2.1.0.16 field mappings.
No compatible cybox 2.1.0.17 mappings found. Loaded latest unchanged 2.1.0.16 field mappings.
[stixmarx.fields] [INFO   ] [2019-04-22 19:56:38,266] No compatible maec 4.1.0.14 mappings found. Loaded latest unchanged 4.1.0.13 field mappings.
No compatible maec 4.1.0.14 mappings found. Loaded latest unchanged 4.1.0.13 field mappings.
/usr/lib/python3.4/site-packages/stix/utils/deprecated.py:48: UserWarning: The use of this field has been deprecated. Received 'VocabList' object.
  warnings.warn(msg)
/usr/lib/python3.4/site-packages/stix/utils/deprecated.py:48: UserWarning: The use of this field has been deprecated. Received 'str' object.
  warnings.warn(msg)
/usr/lib/python3.4/site-packages/stix/utils/deprecated.py:48: UserWarning: The use of this field has been deprecated. Received 'datetime' object.
  warnings.warn(msg)
/usr/lib/python3.4/site-packages/stix/utils/deprecated.py:48: UserWarning: The use of this field has been deprecated. Received 'MarkableText' object.
  warnings.warn(msg)
/usr/lib/python3.4/site-packages/stix/utils/deprecated.py:48: UserWarning: The use of this field has been deprecated. Received 'MarkableDateTime' object.
  warnings.warn(msg)
[stix2elevator.options] [201] [WARNING] [2019-04-22 19:56:38,904] Results produced by the stix2-elevator are not for production purposes.
[stix2elevator.options] [902] [INFO   ] [2019-04-22 19:56:38,905] Using parent object timestamp on 'US-CERT'
[stix2elevator.options] [902] [INFO   ] [2019-04-22 19:56:38,906] Using parent object timestamp on TLPMarkingStructure
[stix2elevator.options] [212] [INFO   ] [2019-04-22 19:56:38,907] Created Marking Structure for TLPMarkingStructure
[stix2elevator.options] [902] [INFO   ] [2019-04-22 19:56:38,907] Using parent object timestamp on TLPMarkingStructure
[stix2elevator.options] [212] [INFO   ] [2019-04-22 19:56:38,907] Created Marking Structure for TLPMarkingStructure
[stix2elevator.options] [625] [INFO   ] [2019-04-22 19:56:38,908] Found same marking structure MarkingSpecification, using marking-definition--b22eeaf7-e413-4944-abc7-b9cecd6902bb
[stix2elevator.options] [902] [INFO   ] [2019-04-22 19:56:38,908] Using parent object timestamp on TermsOfUseMarkingStructure
[stix2elevator.options] [212] [INFO   ] [2019-04-22 19:56:38,908] Created Marking Structure for TermsOfUseMarkingStructure
[stix2elevator.options] [902] [INFO   ] [2019-04-22 19:56:38,909] Using parent object timestamp on TermsOfUseMarkingStructure
[stix2elevator.options] [212] [INFO   ] [2019-04-22 19:56:38,909] Created Marking Structure for TermsOfUseMarkingStructure
[stix2elevator.options] [625] [INFO   ] [2019-04-22 19:56:38,909] Found same marking structure MarkingSpecification, using marking-definition--cbfeec54-6e37-44d6-a61e-db5883b26f67
[stix2elevator.options] [902] [INFO   ] [2019-04-22 19:56:38,949] Using parent object timestamp on TLPMarkingStructure
[stix2elevator.options] [212] [INFO   ] [2019-04-22 19:56:38,950] Created Marking Structure for TLPMarkingStructure
[stix2elevator.options] [625] [INFO   ] [2019-04-22 19:56:38,950] Found same marking structure MarkingSpecification, using marking-definition--b22eeaf7-e413-4944-abc7-b9cecd6902bb
[stix2elevator.options] [902] [INFO   ] [2019-04-22 19:56:38,951] Using parent object timestamp on TermsOfUseMarkingStructure
[stix2elevator.options] [212] [INFO   ] [2019-04-22 19:56:38,951] Created Marking Structure for TermsOfUseMarkingStructure
[stix2elevator.options] [625] [INFO   ] [2019-04-22 19:56:38,952] Found same marking structure MarkingSpecification, using marking-definition--cbfeec54-6e37-44d6-a61e-db5883b26f67
[stix2elevator.options] [902] [INFO   ] [2019-04-22 19:56:39,018] Using parent object timestamp on NCCIC:Observable-0e8214df-8b0e-436e-aa3e-e404e15afd55
[stix2elevator.options] [901] [INFO   ] [2019-04-22 19:56:39,019] 'first_observed' and 'last_observed' data not available directly on NCCIC:Observable-0e8214df-8b0e-436e-aa3e-e404e15afd55 - using timestamp
[stix2elevator.options] [902] [INFO   ] [2019-04-22 19:56:39,024] Using parent object timestamp on NCCIC:Observable-b34a4f16-af0b-417b-a443-553dd08fce5f
[stix2elevator.options] [805] [WARNING] [2019-04-22 19:56:39,024] CybOX object <class 'cybox.objects.artifact_object.Artifact'> not handled yet
Traceback (most recent call last):
  File "stixtransfer.py", line 40, in <module>
    print(elevate_string(stix1.read()))
  File "/usr/lib/python3.4/site-packages/stix2elevator/__init__.py", line 124, in elevate_string
    json_string = json.dumps(convert_package(stix_package, env),
  File "/usr/lib/python3.4/site-packages/stix2elevator/convert_stix.py", line 1798, in convert_package
    o_d20 = convert_observed_data(o_d, env)
  File "/usr/lib/python3.4/site-packages/stix2elevator/convert_stix.py", line 1175, in convert_observed_data
    current_largest_id = max(observed_data_instance["objects"].keys())
AttributeError: 'NoneType' object has no attribute 'keys'

I am using stix2-elevator==2.0.1 and python3.4. Here is stixtransfer.py:

from stix2elevator import elevate_file, elevate_string
from stix2elevator.options import initialize_options as elev_opts, set_option_value as set_elev_opts

def x():
        stix1 = open("MAR-10132963_stix.txt",'r')
        return stix1

stix1 = x()
elev_opts()
set_elev_opts("policy", "no_policy")
print(elevate_string(stix1.read()))

And attached is the file that I've been trying to convert, from this page. I've also uploaded it to github for convenience's sake: MAR-10132963_stix.txt

[rpiazza]

Hi @arcsector,

Thanks for your submission! I'll be looking into it soon

[rpiazza]

@arcsector -
The elevator is not handling related objects that use idrefs and needs to be fixed. Stay tuned :-).

[arcsector]

@rpiazza oh gotcha. Werent idref's deprecated after STIX 1.2? If so maybe it should just be a warning that the idref is deprecated and wont be elevated? Or that refs need to be embedded?

[rpiazza]

Ids and Id refs are the same thing in STIX 2.x. It just depends upon how it is used.

Artifact has no ref properties, but File has a content_ref property, which references an artifact object. This would probably be the best way to represent this content. At any rate, such a transformation is beyond the elevator at this point - so I think a warning is about all we can add.

[arcsector]

Agreed. As long as the no_policy flag allows it to be skipped and elevator doesn't get hung up on it, that's fine.