"S;S<\25r?"S=S>\)5r@g)?zJClasses for representing properties of STIX Objects and Cyber Observables.N) _STIXBase)CustomContentErrorDictionaryKeyError STIXError)parseparse_observable)class_for_type) STIXTypeClass _get_dictget_class_hierarchy_namesget_type_from_id is_object is_stix_typeparse_into_datetimeto_enum)DEFAULT_VERSIONz^-?[a-z0-9]+(-[a-z0-9]+)*-?$z"^([a-z][a-z0-9]*)+([a-z0-9-]+)*-?$zAnot a valid STIX identifier, must match --: {}c[R"U5nUR[R:HnU(aUS:XaURS:HnU$)aL Check whether the given UUID string is valid with respect to the given STIX spec version. STIX 2.0 requires UUIDv4; 2.1 only requires the RFC 4122 variant. :param uuid_str: A UUID as a string :param spec_version: The STIX spec version :return: True if the UUID is valid, False if not :raises ValueError: If uuid_str is malformed 2.0)uuidUUIDvariantRFC_4122version)uuid_str spec_versionuuid_objoks J/home/james-whalen/.local/lib/python3.13/site-packages/stix2/properties.py _check_uuidr!sEyy"H   T]] *B le#    " IcU(a0URU5(d[SRU55eU(aU[U5SnOUR S5nXS-Sn[ X15nU(d[[ RU55eg![a [[ RU55ef=f)a Check the STIX identifier for correctness, raise an exception if there are errors. :param id_: The STIX identifier :param spec_version: The STIX specification version to use :param required_prefix: The required prefix on the identifier, if any. This function doesn't add a "--" suffix to the prefix, so callers must add it if it is important. Pass None to skip the prefix check. :raises ValueError: If there are any errors with the identifier zmust start with '{}'.N--) startswith ValueErrorformatlenindexr!ERROR_INVALID_ID)id_rrequired_prefix uuid_partidxresults r _validate_idr13s~~o..4;;OLM M 7 C012I))D/CEF IY5 )00566  7)005667s 9B)Cc"US:Xa/[R"[U5(d[SU-5eO.[R"[U5(d[SU-5e[ U5S:d[ U5S:a[SU-5eg)z Check the STIX type name for correctness, raise an exception if there are errors. :param type_: The STIX type name :param spec_version: The STIX specification version to use :raises ValueError: If there are any errors with the identifier rzdInvalid type name '%s': must only contain the characters a-z (lowercase ASCII), 0-9, and hyphen (-).zInvalid type name '%s': must only contain the characters a-z (lowercase ASCII), 0-9, and hyphen (-) and must begin with an a-z characterz=Invalid type name '%s': must be between 3 and 250 characters.N)rematch TYPE_REGEXr' TYPE_21_REGEXr))type_rs r _validate_typer:Ssuxx E**I +xx u--79>?   5zA~Uc) Ke S  *r"c6\rSrSrSrSSjrS SjrSSjrSrg) Propertyqa Represent a property of STIX data type. Subclasses can define the following attributes as keyword arguments to ``__init__()``. Args: required (bool): If ``True``, the property must be provided when creating an object with that property. No default value exists for these properties. (Default: ``False``) fixed: This provides a constant default value. Users are free to provide this value explicitly when constructing an object (which allows you to copy **all** values from an existing object to a new object), but if the user provides a value other than the ``fixed`` value, it will raise an error. This is semantically equivalent to defining both: - a ``clean()`` function that checks if the value matches the fixed value, and - a ``default()`` function that returns the fixed value. Subclasses can also define the following functions: - ``def clean(self, value, allow_custom) -> (any, has_custom):`` - Return a value that is valid for this property, and enforce and detect value customization. If ``value`` is not valid for this property, you may attempt to transform it first. If ``value`` is not valid and no such transformation is possible, it must raise an exception. The method is also responsible for enforcing and detecting customizations. If allow_custom is False, no customizations must be allowed. If any are encountered, an exception must be raised (e.g. CustomContentError). If none are encountered, False must be returned for has_custom. If allow_custom is True, then the clean() method is responsible for detecting any customizations in the value (just because the user has elected to allow customizations doesn't mean there actually are any). The method must return an appropriate value for has_custom. Customization may not be applicable/possible for a property. In that case, allow_custom can be ignored, and has_custom must be returned as False. - ``def default(self):`` - provide a default value for this property. - ``default()`` can return the special value ``NOW`` to use the current time. This is useful when several timestamps in the same object need to use the same default value, so calling now() for each property-- likely several microseconds apart-- does not work. Subclasses can instead provide a lambda function for ``default`` as a keyword argument. ``clean`` should not be provided as a lambda since lambdas cannot raise their own exceptions. When instantiating Properties, ``required`` and ``default`` should not be used together. ``default`` implies that the property is required in the specification so this function will be used to supply a value if none is provided. ``required`` means that the user must provide this; it is required in the specification and we can't or don't want to create a default value. cpXR:wa$[SRUR55eUS4$)Nzmust equal '{}'.F) _fixed_valuer'r(selfvalue allow_customs r _default_cleanProperty._default_cleans5 %% %/66t7H7HIJ Je|r"Nc^XlU(aU(a [S5eT(a#TUlURUlU4SjUlU(aX0lgg)NzaCan't use 'required' and 'default' together. 'required'really means 'the user must provide this.'c>T$Nfixedsr #Property.__init__..s5r")requiredrr?rDcleandefault)rArNrKrPs ` r __init__Property.__init__sM =   %D ,,DJ(DL "L r"c US4$NFrIr@s r rOProperty.cleans e|r")r?rOrPrNF)FNN) __name__ __module__ __qualname____firstlineno____doc__rDrQrO__static_attributes__rIr"r r<r<qs9v # r"r<c.^\rSrSrU4SjrSrSrU=r$) ListPropertyc >SUl[R"U5(a>[U[5(a U"5UlO7[U[ 5(aXlO[ U[5(aXlUR(d#[SR[U555e[[U]2"S0UD6 g)zP ``contained`` should be a Property class or instance, or a _STIXBase subclass. NzInvalid list element type: {}rI) containedinspectisclass issubclassr<r isinstance TypeErrorr(strsuperr^rQ)rArakwargs __class__s r rQListProperty.__init__s  ??9 % %)X..!*Iy11!*  8 , ,&N~~/66 N  lD*4V4r"c D[U5 [U[[ 45(aU/n/nSn[UR [5(aCUH<nUR RXR5upgURU5 U=(d UnM> OUHn[XPR 5(aUnOv[U[RR5(aUR "SSU0UD6nO8[SRUR R[ U555eURU5 U=(d URnM U(dU(a [!S5e[#U5S:a [S5eX44$![a [S5ef=f) Nzmust be an iterable.FrCzCan't create a {} out of {}custom content encounteredrmust not be empty.rI)iterrfr'rerrgrar<rOappend collectionsabcMappingr(_type has_customrr))rArBrCr0ruitemvalid temp_customs r rOListProperty.cleansi 5 K ei- . .GE dnnh / /%)^^%9%9$%M" e$'6;  dNN33 Ekoo&=&=>> NNM MME%5<< NN00#d)  e$';5+;+; !$ $%AB B v;?12 2!!Q 534 4 5s F F)rarWrXrYrZrQrOr\ __classcell__rjs@r r^r^s56+"+"r"r^c2^\rSrSrU4SjrSSjrSrU=r$)StringPropertyic .>[[U] "S0UD6 gNrI)rhr~rQ)rArirjs r rQStringProperty.__init__s nd,6v6r"cJ[U[5(d [U5nUS4$rT)rergr@s r rOStringProperty.cleans"%%%JEe|r"rIrVrzr|s@r r~r~s7r"r~c.^\rSrSr\4U4SjjrSrU=r$) TypePropertyicJ>[X5 X l[[U]US9 g)NrJ)r:rrhrrQrAtyperrjs r rQTypeProperty.__init__s#t*( lD**6r"r)rWrXrYrZrrQr\r{r|s@r rrs*977r"rc>^\rSrSr\4U4SjjrSSjrSrSrU=r $) IDPropertyi$cJ>US-UlX l[[U]5 g)Nr$)r-rrhrrQrs r rQIDProperty.__init__&s"#d{( j$(*r"cJ[XRUR5 US4$rT)r1rr-r@s r rOIDProperty.clean+s"U--t/C/CDe|r"cXUR[[R"55-$rH)r-rgruuid4)rAs r rPIDProperty.default/s##c$**,&777r")r-rrV) rWrXrYrZrrQrOrPr\r{r|s@r rr$s*9+ 88r"rc6^\rSrSrSU4SjjrSSjrSrU=r$)IntegerPropertyi3c F>XlX l[[U]"S0UD6 gr)minmaxrhrrQrArrrirjs r rQIntegerProperty.__init__5s ot-77r"c`[U5nURb6XR:a'SR URU5n[U5eUR b6XR :a'SR UR U5n[U5eUS4$![a [S5ef=f)Nzmust be an integer. minimum value is {}. received {} maximum value is {}. received {}F)int Exceptionr'rr(rrArBrCmsgs r rOIntegerProperty.clean:s 4JE 88 EHH$44;;DHHeLCS/ ! 88 EHH$44;;DHHeLCS/ !e| 423 3 4 BB-rrNNrVrzr|s@r rr3s8 r"rc6^\rSrSrSU4SjjrSSjrSrU=r$) FloatPropertyiKc F>XlX l[[U]"S0UD6 gr)rrrhrrQrs r rQFloatProperty.__init__Ms mT+5f5r"c`[U5nURb6XR:a'SR URU5n[U5eUR b6XR :a'SR UR U5n[U5eUS4$![a [S5ef=f)Nzmust be a float.rrF)floatrr'rr(rrs r rOFloatProperty.cleanRs 1%LE 88 EHH$44;;DHHeLCS/ ! 88 EHH$44;;DHHeLCS/ !e| 1/0 0 1rrrrVrzr|s@r rrKs6 r"rc.\rSrSr/SQr/SQrSSjrSrg)BooleanPropertyic)truet1rT)falsef0rFc[U[5(aUR5nXR;aSnUS4$XR;aSnUS4$[ S5e)NTFzmust be a boolean value.)rerglower_trues_falsesr')rArBrCr0s r rOBooleanProperty.cleangs` eS ! !KKME KK F u} ll "Fu}78 8r"rINrV)rWrXrYrZrrrOr\rIr"r rrcs (F+G r"rc6^\rSrSrSU4SjjrSSjrSrU=r$)TimestampPropertyivc F>XlX l[[U]"S0UD6 gr) precisionprecision_constraintrhrrQ)rArrrirjs r rQTimestampProperty.__init__xs!"$8! /9&9r"cF[XRUR5S4$rT)rrrr@s r rOTimestampProperty.clean~s&" >>4#<#<  r")rr)anyexactrVrzr|s@r rrvs: r"rc8^\rSrSr\4U4SjjrSSjrSrU=r$)DictionaryPropertyic :>Xl[[U]"S0UD6 gr)rrhrrQ)rArrirjs r rQDictionaryProperty.__init__s(  $0:6:r"c[U5nUR5HnURS:Xa7[ U5S:a [ US5e[ U5S:a [ US5eO+URS:Xa[ U5S:a [ US 5e[ R"S U5(aMS n[ XE5e [ U5S :a [S 5eUS4$![a [S5ef=f)Nz1The dictionary property must contain a dictionaryrr3zshorter than 3 characterszlonger than 256 charactersz2.1r4zlonger than 250 charactersz^[a-zA-Z0-9_-]+$zhcontains characters other than lowercase a-z, uppercase A-Z, numerals 0-9, hyphen (-), or underscore (_)rrnF)r r'keysrr)rr5r6)rArBrC dictifiedkrs r rODictionaryProperty.cleans R!%(I!A  E)q6A:,Q0KLLVc\,Q0LMM"""e+q6C<,Q0LMM88/33% )00"" y>A 12 2%- RPQ Q Rs CC3rrV rWrXrYrZrrQrOr\r{r|s@r rrs$3;  r"rc:^\rSrSr\4U4SjjrU4SjrSrU=r$)HashesPropertyic >[TU]"SSU0UD6 Xl0UlUH9n[R R U5nU(dM+X@RU'M; g)NrrI)rhrQ _HashesProperty__spec_hash_names!_HashesProperty__alg_to_spec_namestix2hashesinfer_hash_algorithm)rAspec_hash_namesrrispec_hash_namealgrjs r rQHashesProperty.__init__sY =l=f=!0#%-N,,33NCCs/='',.r"c>[T U]X5up40nSnUR5Hupx[RR U5n U (ao[RR X5(d$[SRXR55eURRU 5n U (dSnUn OUn XR;aSnU(dU(a[SU-5eXU 'M XV4$)NFz'{0}' is not a valid {1} hashTzcustom hash algorithm: )rhrOitemsrrr check_hashr'r(namergetrr) rArBrC clean_dict_ spec_dictruhash_khash_vhash_alg spec_namerjs r rOHashesProperty.cleans e:   (..0NF||88@H||..x@@$7>>"MM !3377A  "&J &I # $:$::!%JJ(-6$*i C1F$$r")__alg_to_spec_name__spec_hash_namesrr|s@r rrs5D >+%+%r"rc\rSrSrSSjrSrg)BinaryPropertyic[R"U5 US4$![R[4a [ S5ef=f)Nz$must contain a base64 encoded stringF)base64 b64decodebinasciiErrorrfr'r@s r rOBinaryProperty.cleansJ E   U #e| * ECD D Es &ArINrVrWrXrYrZrOr\rIr"r rrsr"rc\rSrSrSSjrSrg) HexPropertyicX[R"SU5(d [S5eUS4$)Nz^([a-fA-F0-9]{2})+$z5must contain an even number of hexadecimal charactersF)r5r6r'r@s r rOHexProperty.cleans*xx.66TU Ue|r"rINrVrrIr"r rrr"rcN^\rSrSr\"S5urrSS\4U4SjjrSr Sr U=r $)ReferencePropertyir%Nc |>X0lUbUcUcUc [S5eU(a[U[5(dU/nOU(a[U[5(dU/nUb[ U5S:Xa [S5eU(a UR O UR Ul[5Ul [5Ul U=(d UnUH/n[U[5nURRU5 M1 [[ U]F"S0UD6 g![a URRU5 Mpf=f)z8 references sometimes must be to a specific object type Nz>Exactly one of 'valid_types' and 'invalid_types' must be givenrz+Impossible type constraint: empty whitelistrI)rr'relistr) _WHITELIST _BLACKLIST auth_typesetgenerics specificsrr addKeyErrorrhrrQ) rA valid_types invalid_typesrritypesr9 enum_valuerjs r rQReferenceProperty.__init__s)  # (A$)>  z+t<<&-K :mT#B#B*OM  "s;'71'<JK K,7T__  ,}E .$UM:  !!*-  /9&9  *""5) *sD%D;:D;c[U[5(a URn[U5n[ XR S5 [ U5n[5nURnURnURnU(a6XpR:Xa'U(a URn[[5U- nXdpdXpR:Xa"[X0R /UQ76=(d X6;nO1[X0R /UQ76(+=(a X6;=(d X4;n[X0R 5(+=(d UR!S5n U(dURR#UR5n SR%SU 55n URUR:XaSU -n OSU -n U(d U (aU S- n ['SU<SU <35eU(dU (a[)S U-5eX4$) Nzx-z, c3h# UH(n[U[5(a UROUv M* g7frH)rer r).0xs r *ReferenceProperty.clean..Us([UZPQ 1m(D(Daff!KUZs02z1not one of the valid types for this property: %s.z/one of the invalid types for this property: %s.z< A custom object type may be allowed with allow_custom=True.zThe type-specifying prefix 'z' for this property is z!reference to custom object type: )reridrgr1rrrrrrrrr rrr&unionjoinr'r) rArBrCobj_typeblacklist_exceptionsrrrtype_okrurrs r rOReferenceProperty.clean s eY ' 'HHEE U--t4#E* #u==NN NN I8XI=)H4H.7)  '"++.6'&  !//2:0/21 #8->->??)""4( NN((7EII[UZ[[E~~0IEQG%OJUUS"   $3h>   r")rrrr) rWrXrYrZrangerrrrQrOr\r{r|s@r rrs*"1XJ #'t/%:NF!F!r"rz8^([a-z0-9_-]{3,250}(\.(\[\d+\]|[a-z0-9_-]{1,250}))*|id)$c\rSrSrSSjrSrg)SelectorPropertyilcT[RU5(d [S5eUS4$)Nzmust adhere to selector syntax.F)SELECTOR_REGEXr6r'r@s r rOSelectorProperty.cleanns)##E**>? ?e|r"rINrVrrIr"r rrlrr"rc,^\rSrSrSU4SjjrSrU=r$)ObjectReferencePropertyitc r>U(a[U5[LaU/nXl[[U]"S0UD6 gr)rrrrhrrQ)rArrirjs r rQ ObjectReferenceProperty.__init__vs2 4 ,D8&-K& %t5??r")rrH)rWrXrYrZrQr\r{r|s@r rrts@@r"rc.^\rSrSrU4SjrSrSrU=r$)EmbeddedObjectPropertyi}c :>Xl[[U]"S0UD6 gr)rrhr!rQ)rArrirjs r rQEmbeddedObjectProperty.__init__s  $d4>v>r"cd[U[5(aUR"SSU0UD6nOH[XR5(d.[SR URR 55eSn[U[ 5(a URnU(dU(a [S5eX4$)NrCzmust be of type {}.FrmrI) redictrr'r(rWrrur)rArBrCrus r rOEmbeddedObjectProperty.cleans eT " "IIA<A5AEE99--299$)):L:LMN N eY ' '))J $%AB B  r")rrzr|s@r r!r!}s? ! !r"r!c8^\rSrSrSrU4SjrU4SjrSrU=r$) EnumPropertyiz\ Used for enumeration type properties. Properties of this type do not allow customization. c j>[U[5(aU/nXl[[U]"S0UD6 gr)rergallowedrhr(rQrAr*rirjs r rQEnumProperty.__init__s. gs # #iG  lD*4V4r"c>[[U] X5up4X0R;a[ SR U55eUS4$)Nz-value '{}' is not valid for this enumeration.F)rhr(rOr*r'r()rArBrC cleaned_valuerrjs r rOEnumProperty.cleansD t:5O  ,LSSTabc ce##r"r* rWrXrYrZr[rQrOr\r{r|s@r r(r(s 5 $$r"r(c8^\rSrSrSrU4SjrU4SjrSrU=r$)OpenVocabPropertyiz& Used for open vocab type properties. c j>[[U] "S0UD6 [U[5(aU/nXlgr)rhr3rQrergr*r+s r rQOpenVocabProperty.__init__s/ /9&9 gs # #iG r"c8>[[U] X5up4SnX54$rT)rhr3rO)rArBrCr.rrurjs r rOOpenVocabProperty.cleans+ !2D?    ((r"r0r1r|s@r r3r3s))r"r3c\rSrSrSrg)PatternPropertyirIN)rWrXrYrZr\rIr"r r9r9sr"r9c8^\rSrSrSr\4U4SjjrSrSrU=r $)ObservablePropertyiz3Property for holding Cyber Observable Objects. c:>Xl[[U]"U0UD6 grH)rrhr;rQrArargsrirjs r rQObservableProperty.__init__(  $0$A&Ar"c[U5n[R"U5nU0:Xa [S5eUR 5VVs0sH upEXES_M nnnSnUR 5Hwup[ U UUUR S9n [U [5(aU=(d U RnOSnU(d$U(a[SRU S55eXU'My X74$![a [S5ef=fs snnf)Nz1The observable property must contain a dictionaryz;The observable property must contain a non-empty dictionaryrF)rCrTzcustomized {} observable found) r copydeepcopyr'rr rrerrurr() rArBrCrrv valid_refsrukeyobj parsed_objs r rOObservableProperty.cleans R!%(I i0I ?Z[ [1:1BC1Bva6l1B C !)HC)))) J*i00'@:+@+@ " J(4;;"6* (cN+*.$$? RPQ Q R Ds!C+D+Dr rWrXrYrZr[rrQrOr\r{r|s@r r;r;s%4B&%&%r"r;c:^\rSrSrSr\S4U4SjjrSrSrU=r $)ExtensionsPropertyiz@Property for representing extensions on Observable objects. Fc(>[[U] XS9 g)N)rrN)rhrLrQ)rArrNrjs r rQExtensionsProperty.__init__s  $0l0^r"c [U5n[R"U5nSnUR 5GHupV[ XPR S5nU(a[U[5(a U"S SU0UD6nO7[Xg5(aUnO$[SRU[U555eU=(d URnU(d!U(a[SRU55eXU'MURS5(a[XPR S5 O$U(aSnO[S RU55eXcU'GM X44$![a [S5ef=f) Nz1The extensions property must contain a dictionaryF extensionsrCz$Can't create extension '{}' from {}.z$custom content found in {} extensionzextension-definition--Tz&Can't parse unknown extension type: {}rI)r rBrCr'rr rrer%rfr(rrurr&r1) rArBrCrrurFsubvalueclsexts r rOExtensionsProperty.cleans^ R!%(I i0I &__.MC &7&7FCh--D<D8DC..#C#>EEh (93>> # ,>EE "%#>>":;; ..0H"!%J,-U-\-\]`-abb!)#Y/\$$e RPQ Q Rs !EE%rIrJr|s@r rLrLs%4e_9%9%r"rLc4^\rSrSr\4U4SjjrSrSrU=r$)STIXObjectPropertyiAc:>Xl[[U]"U0UD6 grH)rrhrVrQr=s r rQSTIXObjectProperty.__init__Cr@r"c^1Skm[U4Sj[U555(aQSU;aURS:Xa [S5eU(dUR(a [ S5eXR4$[ U5nU0:Xa [S5eS U;aUS S :Xa [S 5eSU;aURS:Xa [S5e[X2S 9n[U[5(a URnOS nU(d$U(a[ SRUS 55eXE4$![a [S5ef=f)N> _DomainObjectMarkingDefinition_RelationshipObjectc3.># UH nUT;v M g7frHrI)r r  stix2_classess r r +STIXObjectProperty.clean..Ks 5  5srrzZSpec version 2.0 bundles don't yet support containing objects of a different spec version.rmz5This property may only contain a dictionary or objectz?This property may only contain a non-empty dictionary or objectrbundlez-This property may not contain a Bundle object)rCTzcustomized {} object found) rr rr'rurr rrerr()rArBrCrrHrur^s @r rOSTIXObjectProperty.cleanGsgV  .u5   &4+<+<+E   E$4$4()EFF*** * V!%(I ?^_ _ Y 9V#4#@LM M Y &4+<+<+EB  9@ j) , ,#..JJ %,33v&  %%? VTU U Vs ; D--Errr|s@r rVrVAs$3B:&:&r"rV)Ar[rrcollections.abcrqrBrbr5rr stix2.hashesbaser exceptionsrrrparsingrr registryr utilsr r r rrrrrrrcompiler7r8r+r!r1r:objectr<r^r~rrrrrrrrrrrrrrr!r(r3r9r;rLrVrIr"r rksP   II,$% ZZ7 8  @A G (7@ $*))B n .%.%b@%+@%F@&@&r"