Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

malware-behavior $refs URLs point to /malware-behavior/ instead of /malware-behavior-8e9/ #80

Open
dunkeki opened this issue Nov 18, 2024 · 9 comments

Comments

@dunkeki
Copy link

dunkeki commented Nov 18, 2024

Don't know if these have been fixed by Charles et al, but they're broken in cti-stix-common-objects/extension-definition-specifications/malware-behavior-8e9/ ... thanks!

@dunkeki
Copy link
Author

dunkeki commented Nov 18, 2024

Part of the problem is that these are absolute URLs - the problem wouldn't be so profound if they were relative refs...

@rpiazza
Copy link
Contributor

rpiazza commented Nov 18, 2024

@dunkeki - I made the changes to add 8e9 to the urls that were missing it. It is on the malware-behavior-8e9 branch.
Please test it. If it is ok I will merge it in.

@dunkeki
Copy link
Author

dunkeki commented Nov 18, 2024

Missed one in extension-definition--8e9e338f-c9ee-4d4f-8cac-85b4dcfdf3c1.json, thanks.

@rpiazza
Copy link
Contributor

rpiazza commented Nov 18, 2024

Done

@dunkeki
Copy link
Author

dunkeki commented Nov 18, 2024

Since the $ref URLs are absolute to raw GitHub, I can't test. Things are probably correct (well, the current version is broken so merging what is probably correct is a good thing). Can you please merge? Thanks.

If you know a way around this without merging, let me know...

@dunkeki
Copy link
Author

dunkeki commented Nov 18, 2024

Those $ref should be relative. Then my local copy (which is corrected by you, thanks) would be used and work :(

@dunkeki
Copy link
Author

dunkeki commented Nov 18, 2024

If you'd like, I can fix my local copy, get it working (AFAIK), and then post a tarball back to here...

@rpiazza
Copy link
Contributor

rpiazza commented Nov 18, 2024

I'm not 100% sure why absolute urls were used, if it was necessary. Let me do the merge, then you can experiment.

@dunkeki
Copy link
Author

dunkeki commented Nov 18, 2024

malware-behavior-8e9.TGZ

In addition to relativizing the $ref, there were a number of JSON errors in examples/behavior-unprotect.json (e.g. extra commas on a last array element, etc.). That file has been fixed as well (even though it won't pass schema validation - as intended - but the schema still work referencing each other etc.)

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants