Validation should fail when `*_bin` values aren't base64 encoded about cti-stix-validator HOT 7 CLOSED

Thanks, @rpatterson!

cti-stix-validator defers to cti-pattern-validator to validate the patterns, so it would probably be best to fix this in the pattern validator. Both cti-pattern-matcher and cti-pattern-validator use the same ANTLR grammar, but it's possible the pattern matcher does more restrictive checks when actually matching the patterns than the validator does when validating it; if so, that should be fixed.

Do you have some example data that demonstrates this?

cc: @clenk @chisholm

from cti-stix-validator.

I may misunderstand, but the validator merely validates patterns. It doesn't do anything with observed data. So that phrase "that same observed data doesn't show up as a validation error" doesn't really make sense. I don't think the validator is intended to "pre-check" observed data against a pattern to determine whether an attempted pattern match would cause an error.

But if I am misunderstanding, a concrete example would help!

from cti-stix-validator.

The issue I'm describing isn't that the pattern is invalid, but that the observed data is invalid. I only mention running the pattern matcher to demonstrate that the values I'm talking about are invalid. So I'll start over and try to state it more simply.

If a STIX observed data's objects property contains an artifact object with a payload_bin property, it's contents should be base64 encoded and so such an observed data artifact should fail validation if the value is not base64 encoded. Currently such values do not fail validation. For example...

{
  "type": "artifact", 
  "mime_type": "application/octet-stream",
  "payload_bin": "I am not base64 encoded"
}

...should fail validation but currently it succeeds.

I stated it more broadly above because cti-pattern-matcher decodes all properties whose names end with _bin or _hex. So on that count it seems like either cti-pattern-matcher should be more explicit in which properties it decodes, or the this validator should be more broad in which properties it requires to be encoded.

from cti-stix-validator.

Oh, I misread the original comment. I assumed it was the pattern with unencoded data that was causing an error, not the observed-data. Sorry.

from cti-stix-validator.

@rpatterson: your comment above was seconds before my comment where I realized my mistake (so now I feel extra bad about it!). It does make sense for the cti-stix-validator to check that the values of any property ending in _bin is valid Base64 data. I think @clenk is already working on fixing this (despite me sending everyone down the wrong trail with my first comment).

from cti-stix-validator.

The JSON schemas used by the STIX validator were not correctly checking for Base64 encoded strings, but I have submitted a fix. Thank you for finding the bug!

from cti-stix-validator.

Thanks, @clenk. I'm going to leave this open until we incorporate the schema changes into the validator.

from cti-stix-validator.