Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

offset-naive and offset-aware datetime comparison in STIX2 to MISP converter #5

Open
ClevenL opened this issue Feb 27, 2025 · 1 comment

Comments

@ClevenL
Copy link

ClevenL commented Feb 27, 2025

I'm trying to convert STIX 2.1 format to MISP using ExternalSTIX2toMISPParser class. This gives me the following error:

File "/srv/xxx", line 30, in main
    stix_parser.parse_stix_content(f"{collection_title}.tmp")
  File "/usr/local/lib/python3.12/dist-packages/misp_stix_converter/stix2misp/stix2_to_misp.py", line 169, in parse_stix_content
    self.parse_stix_bundle(**kwargs)
  File "/usr/local/lib/python3.12/dist-packages/misp_stix_converter/stix2misp/external_stix2_to_misp.py", line 55, in parse_stix_bundle
    self._parse_stix_bundle()
  File "/usr/local/lib/python3.12/dist-packages/misp_stix_converter/stix2misp/stix2_to_misp.py", line 179, in _parse_stix_bundle
    getattr(self, feature)()
  File "/usr/local/lib/python3.12/dist-packages/misp_stix_converter/stix2misp/stix2_to_misp.py", line 497, in _parse_bundle_with_no_report
    self._parse_loaded_features()
  File "/usr/local/lib/python3.12/dist-packages/misp_stix_converter/stix2misp/external_stix2_to_misp.py", line 261, in _parse_loaded_features
    super()._parse_loaded_features()
  File "/usr/local/lib/python3.12/dist-packages/misp_stix_converter/stix2misp/stix2_to_misp.py", line 540, in _parse_loaded_features
    self._handle_object(object_type, object_ref)
  File "/usr/local/lib/python3.12/dist-packages/misp_stix_converter/stix2misp/stix2_to_misp.py", line 396, in _handle_object
    parser.parse(object_ref)
  File "/usr/local/lib/python3.12/dist-packages/misp_stix_converter/stix2misp/converters/stix2_observed_data_converter.py", line 103, in parse
    self._parse_observable_object_refs(observed_data)
  File "/usr/local/lib/python3.12/dist-packages/misp_stix_converter/stix2misp/converters/stix2_observed_data_converter.py", line 140, in _parse_observable_object_refs
    parser(observed_data)
  File "/usr/local/lib/python3.12/dist-packages/misp_stix_converter/stix2misp/converters/stix2_observed_data_converter.py", line 721, in _parse_domain_observable_object_refs
    self._handle_misp_object_fields(
  File "/usr/local/lib/python3.12/dist-packages/misp_stix_converter/stix2misp/converters/stix2_observed_data_converter.py", line 2214, in _handle_misp_object_fields
    if time_fields[field] > misp_object.get(field, datetime.max):
       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
TypeError: can't compare offset-naive and offset-aware datetimes

This makes sense since datetime.max is offset-naive. Am I missing something or is this a bug?

if time_fields[field] > misp_object.get(field, datetime.max):

@ClevenL
Copy link
Author

ClevenL commented Feb 27, 2025

I removed the checks from my package. Didn't seem to be too important. It fixed the issue. For now at least.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant