Comparing d754f58c1a..6ba6d2ebb8 - mvt - MS-GitHub-Backup (Gitea)

CalvinBackup/mvt

Fork 0

mirror of https://github.com/mvt-project/mvt.git synced 2026-04-08 04:52:24 +02:00

Author	SHA1	Message	Date
besendorf	6ba6d2ebb8	Merge branch 'main' into fix/stix2-hash-key-normalization	2026-04-07 20:40:01 +02:00
Janik Besendorf	e80a05992e	Fix STIX2 hash key parsing to accept spec-compliant algorithm names The STIX2 specification requires single quotes around hash algorithm names that contain hyphens (e.g. file:hashes.'SHA-256'). MVT only accepted a non-standard lowercase form (file:hashes.sha256), silently dropping any indicators using the spec-correct spelling. Normalize hash algorithm keys in _process_indicator by stripping quotes and hyphens from the algorithm portion before matching, so all of the following are accepted for SHA-256, SHA-1 and MD5: file:hashes.'SHA-256' (STIX2 spec) file:hashes.SHA-256 file:hashes.SHA256 file:hashes.sha256 (previously the only accepted form) The same normalization is applied to app:cert.* keys. Update generate_stix.py to use the spec-compliant quoted forms, and add test_parse_stix2_hash_key_variants to cover all spelling variants.	2026-04-07 20:38:37 +02:00
Janik Besendorf	47330e4e45	Fix betterproto2 migration: update generated proto code and callers The dependency switch from betterproto to betterproto2 was incomplete. This updates all affected files to use the betterproto2 API: - tombstone.py: rewrite generated code to use betterproto2.field() with explicit TYPE_* constants, repeated/optional/group flags, and map_meta() for map fields - tombstone_crashes.py: update import and fix to_dict() call to use keyword-only casing= argument required by betterproto2 - pyproject.toml: replace betterproto[compiler] dev dep with betterproto2-compiler - Makefile: update protoc plugin flag to --python_betterproto2_out	2026-04-07 14:07:19 +02:00

Author

SHA1

Message

Date

besendorf

6ba6d2ebb8

Merge branch 'main' into fix/stix2-hash-key-normalization

2026-04-07 20:40:01 +02:00

Janik Besendorf

e80a05992e

Fix STIX2 hash key parsing to accept spec-compliant algorithm names

The STIX2 specification requires single quotes around hash algorithm
names that contain hyphens (e.g. file:hashes.'SHA-256'). MVT only
accepted a non-standard lowercase form (file:hashes.sha256), silently
dropping any indicators using the spec-correct spelling.

Normalize hash algorithm keys in _process_indicator by stripping quotes
and hyphens from the algorithm portion before matching, so all of the
following are accepted for SHA-256, SHA-1 and MD5:

  file:hashes.'SHA-256'   (STIX2 spec)
  file:hashes.SHA-256
  file:hashes.SHA256
  file:hashes.sha256      (previously the only accepted form)

The same normalization is applied to app:cert.* keys.

Update generate_stix.py to use the spec-compliant quoted forms, and add
test_parse_stix2_hash_key_variants to cover all spelling variants.

2026-04-07 20:38:37 +02:00

Janik Besendorf

47330e4e45

Fix betterproto2 migration: update generated proto code and callers

The dependency switch from betterproto to betterproto2 was incomplete.
This updates all affected files to use the betterproto2 API:

- tombstone.py: rewrite generated code to use betterproto2.field() with
  explicit TYPE_* constants, repeated/optional/group flags, and map_meta()
  for map fields
- tombstone_crashes.py: update import and fix to_dict() call to use
  keyword-only casing= argument required by betterproto2
- pyproject.toml: replace betterproto[compiler] dev dep with betterproto2-compiler
- Makefile: update protoc plugin flag to --python_betterproto2_out

2026-04-07 14:07:19 +02:00

1 changed files with 1 additions and 1 deletions

									
										2

.github/workflows/add-issue-to-project.yml
									
										vendored
									
												View File
												
				@@ -11,7 +11,7 @@ jobs:

				    name: Add issue to project

				    runs-on: ubuntu-latest

				    steps:

				      - uses: actions/add-to-project@v0.5.0

				      - uses: actions/add-to-project@v1

				        with:

				          # You can target a project in a different organization

				          # to the issue

Compare commits

3 Commits

main ... fix/stix2-

2

.github/workflows/add-issue-to-project.yml vendored

View File

Compare commits

3 Commits main ... fix/stix2-

2 .github/workflows/add-issue-to-project.yml vendored Unescape Escape View File

3 Commits

main ... fix/stix2-

2

.github/workflows/add-issue-to-project.yml vendored

View File