指示器 _process_indicator 在任何包含"="的 STIX 模式上崩溃
作者: DonnchaC创建于 2026年8月27日更新于 2026年8月27日
bad.stix2:
{"type":"bundle","id":"bundle--00000000-0000-4000-8000-000000000000","objects":[
{"type":"malware","spec_version":"2.1","id":"malware--00000000-0000-4000-8000-000000000001","created":"2026-01-01T00:00:00Z","modified":"2026-01-01T00:00:00Z","name":"Demo","is_family":false},
{"type":"indicator","spec_version":"2.1","id":"indicator--00000000-0000-4000-8000-000000000002","created":"2026-01-01T00:00:00Z","modified":"2026-01-01T00:00:00Z","indicator_types":["malicious-activity"],"pattern":"[domain-name:value='good-domain.example']","pattern_type":"stix","valid_from":"2026-01-01T00:00:00Z"},
{"type":"indicator","spec_version":"2.1","id":"indicator--00000000-0000-4000-8000-000000000003","created":"2026-01-01T00:00:00Z","modified":"2026-01-01T00:00:00Z","indicator_types":["malicious-activity"],"pattern":"[url:value='https://example.com/track?id=1']","pattern_type":"stix","valid_from":"2026-01-01T00:00:00Z"},
{"type":"relationship","spec_version":"2.1","id":"relationship--00000000-0000-4000-8000-000000000004","created":"2026-01-01T00:00:00Z","modified":"2026-01-01T00:00:00Z","relationship_type":"indicates","source_ref":"indicator--00000000-0000-4000-8000-000000000002","target_ref":"malware--00000000-0000-4000-8000-000000000001"},
{"type":"relationship","spec_version":"2.1","id":"relationship--00000000-0000-4000-8000-000000000005","created":"2026-01-01T00:00:00Z","modified":"2026-01-01T00:00:00Z","relationship_type":"indicates","source_ref":"indicator--00000000-0000-4000-8000-000000000003","target_ref":"malware--00000000-0000-4000-8000-000000000001"}
]}$ MVT_STIX2=bad.stix2 mvt-ios check-iocs ./results
...
File ".../mvt/common/indicators.py", line 72, in _check_stix2_env_variable
self.parse_stix2(path)
File ".../mvt/common/indicators.py", line 317, in parse_stix2
self._process_indicator(indicator, collection)
File ".../mvt/common/indicators.py", line 119, in _process_indicator
…内容来源: mvt-project/mvt