Merge pull request #125 from opencybersecurityalliance/develop

2.3.34

.github/workflows/testing.yml

@@ -29,5 +29,5 @@ jobs:
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v3
         with:
-          fail_ci_if_error: true
+          fail_ci_if_error: false
           verbose: true

firepit/__init__.py

@@ -2,7 +2,7 @@
 
 __author__ = """IBM Security"""
 __email__ = 'pcoccoli@us.ibm.com'
-__version__ = '2.3.33'
+__version__ = '2.3.34'
 
 
 import re

firepit/stix20.py

@@ -128,7 +128,7 @@ def obs_conj(self, lhs, rhs):
         return self.conj(lhs, rhs)
 
     def comp_grp(self, exp):
-        return f'({exp})'
+        return f'({exp})' if exp else None
 
     def simple_comp_exp(self, lhs, op, rhs):
         return self._make_comp(lhs, op, rhs)

setup.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 2.3.33
+current_version = 2.3.34
 commit = True
 tag = True
 

setup.py

@@ -64,6 +64,6 @@
     test_suite='tests',
     tests_require=test_requirements,
     url='https://github.com/opencybersecurityalliance/firepit',
-    version='2.3.33',
+    version='2.3.34',
     zip_safe=False,
 )

tests/test_storage.py

@@ -792,3 +792,17 @@ def test_value_counts(fake_bundle_file, tmpdir):
     assert henry['count'] == 2
     isabel = [i for i in data if i['account_login'] == 'isabel'][0]
     assert isabel['count'] == 12
+
+
+def test_extract_outside_pattern(fake_bundle_file, tmpdir):
+    """
+    Conjunction using properties "outside" the returned entity type inside parens caused issues
+    https://github.com/opencybersecurityalliance/firepit/issues/124
+    """
+    with open(fake_bundle_file, 'r') as fp:
+        bundle = ujson.loads(fp.read())
+
+    store = tmp_storage(tmpdir)
+    store.cache('q1', bundle)
+
+    store.extract('nt', 'network-traffic', 'q1', "[(url:value LIKE '%page/1%' AND x-oca-asset:hostName LIKE 'pc%')]")