stix-rust 0.1.0__tar.gz

stix_rust-0.1.0/Cargo.toml

@@ -0,0 +1,19 @@
+[workspace]
+resolver = "2"
+members = ["crates/stix-pattern", "crates/stix-model", "crates/stix-matcher", "crates/stix", "crates/stix-ffi"]
+exclude = ["bindings/python", "bindings/typescript-node", "bindings/typescript-wasm", "bindings/java/rust"]
+
+[workspace.package]
+edition = "2021"
+license = "MIT OR Apache-2.0"
+repository = "https://github.com/benjamin-small/stix-rust"
+
+[workspace.dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+thiserror = "1"
+regex = "1"
+stix-pattern = { path = "crates/stix-pattern", version = "0.1.0" }
+stix-model = { path = "crates/stix-model", version = "0.1.0" }
+stix-matcher = { path = "crates/stix-matcher", version = "0.1.0" }
+stix = { path = "crates/stix", package = "stix-rust", version = "0.1.0" }

stix_rust-0.1.0/PKG-INFO

@@ -0,0 +1,6 @@
+Metadata-Version: 2.4
+Name: stix-rust
+Version: 0.1.0
+Summary: Python bindings for the stix-rust toolkit (parse, import, match STIX 2.1).
+License: MIT OR Apache-2.0
+Requires-Python: >=3.8

stix_rust-0.1.0/bindings/python/.gitignore

@@ -0,0 +1,5 @@
+.venv/
+target/
+__pycache__/
+*.so
+.pytest_cache/

stix_rust-0.1.0/bindings/python/Cargo.lock

@@ -0,0 +1,309 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "libc"
+version = "0.2.186"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+
+[[package]]
+name = "memchr"
+version = "2.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "portable-atomic"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.106"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "pyo3"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd274650b21d4bfc26a0a47587962c1edb425f69287324355cd040c3ea66071c"
+dependencies = [
+ "libc",
+ "once_cell",
+ "portable-atomic",
+ "pyo3-build-config",
+ "pyo3-ffi",
+ "pyo3-macros",
+]
+
+[[package]]
+name = "pyo3-build-config"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5e2a7d2f0d013342f295c048ad19237add5154a55b1c5a254c0ec93d4109078"
+dependencies = [
+ "target-lexicon",
+]
+
+[[package]]
+name = "pyo3-ffi"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca85c467da1bbc8d866eea5deff9cf29ea5f7785054a17da36e65bda9c05845b"
+dependencies = [
+ "libc",
+ "pyo3-build-config",
+]
+
+[[package]]
+name = "pyo3-macros"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ac53762fd065daa3194dd09337a38bd793a188100fd1a9304c4ab312d901771"
+dependencies = [
+ "proc-macro2",
+ "pyo3-macros-backend",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pyo3-macros-backend"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca3a1557399783172dc5bf39cfca835157732532cba56b71d2292161e53b362"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "pythonize"
+version = "0.29.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ec376e1216e0c929a74964ce2020012a1a39f32d80e78aa688721219ea7fb89"
+dependencies = [
+ "pyo3",
+ "serde",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "regex"
+version = "1.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
+
+[[package]]
+name = "serde"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+dependencies = [
+ "serde_core",
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.228"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.150"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "stix-ffi"
+version = "0.1.0"
+dependencies = [
+ "serde_json",
+ "stix-rust",
+ "thiserror",
+]
+
+[[package]]
+name = "stix-matcher"
+version = "0.1.0"
+dependencies = [
+ "regex",
+ "stix-model",
+ "stix-pattern",
+ "thiserror",
+]
+
+[[package]]
+name = "stix-model"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "serde_json",
+ "thiserror",
+]
+
+[[package]]
+name = "stix-pattern"
+version = "0.1.0"
+dependencies = [
+ "serde",
+ "thiserror",
+]
+
+[[package]]
+name = "stix-python"
+version = "0.1.0"
+dependencies = [
+ "pyo3",
+ "pythonize",
+ "serde_json",
+ "stix-ffi",
+]
+
+[[package]]
+name = "stix-rust"
+version = "0.1.0"
+dependencies = [
+ "stix-matcher",
+ "stix-model",
+ "stix-pattern",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.118"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.13.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
+
+[[package]]
+name = "zmij"
+version = "1.0.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"

stix_rust-0.1.0/bindings/python/Cargo.toml

@@ -0,0 +1,18 @@
+[package]
+name = "stix-python"
+version = "0.1.0"
+edition = "2021"
+license = "MIT OR Apache-2.0"
+repository = "https://github.com/benjamin-small/stix-rust"
+description = "Python bindings for the stix-rust toolkit."
+readme = "README.md"
+
+[lib]
+name = "_stix"
+crate-type = ["cdylib"]
+
+[dependencies]
+stix-ffi = { path = "../../crates/stix-ffi", version = "0.1.0" }
+pyo3 = { version = "0.29", features = ["extension-module", "abi3-py38"] }
+pythonize = "0.29"
+serde_json = "1"

stix_rust-0.1.0/bindings/python/README.md

@@ -0,0 +1,59 @@
+# stix-rust — Python binding
+
+Python bindings for the [stix-rust](../../README.md) toolkit — parse STIX 2.1
+patterns, import STIX bundles, match patterns against observations, and register
+custom object types, from Python.
+
+- **Toolchain:** PyO3 + maturin. Module `stix` (compiled core `stix._stix`).
+- **Surface:** typed handles (`Engine`, `Pattern`, `Bundle`, `MatchResult`); deep
+  structure (the pattern AST, bundle objects) as native `dict`/`list`.
+
+## Install (from source)
+
+```bash
+pip install "maturin>=1.5,<2.0"
+cd bindings/python
+maturin develop          # builds the extension into the active venv
+```
+
+## Usage
+
+```python
+import stix
+
+engine = stix.Engine()
+pattern = engine.parse_pattern("[ipv4-addr:value = '198.51.100.5']")
+print(pattern.ast)                      # AST as a dict
+
+bundle = engine.parse_bundle(open("bundle.json").read())
+print(len(bundle), [o["type"] for o in bundle])
+
+result = engine.match_bundle(pattern, bundle)
+print(result.matched, result.observations)
+```
+
+### Custom object types
+
+Register a `dict -> dict` hook; it runs at import time and may add computed
+properties or raise to reject (surfaced as `stix.ValidationError`):
+
+```python
+def normalize(obj):
+    obj["risk_band"] = "high" if obj.get("risk_score", 0) > 80 else "low"
+    return obj
+
+engine.register_type("x-acme-widget", normalize)
+```
+
+### Errors
+
+`stix.StixError` is the base; `ParseError`, `ModelError`, `MatchError`, and
+`ValidationError` are subclasses.
+
+## Test
+
+```bash
+cd bindings/python
+maturin develop
+python -m pytest -q
+```

stix_rust-0.1.0/bindings/python/src/engine.rs

@@ -0,0 +1,67 @@
+//! The Engine pyclass: parse patterns/bundles and run matches.
+use pyo3::prelude::*;
+
+use crate::errors::to_pyerr;
+use crate::handles::{Bundle, MatchResult, Pattern};
+
+#[pyclass]
+pub struct Engine {
+    inner: stix_ffi::Engine,
+}
+
+#[pymethods]
+impl Engine {
+    #[new]
+    fn new() -> Self {
+        Engine {
+            inner: stix_ffi::Engine::new(),
+        }
+    }
+
+    /// Parse a STIX pattern string into a Pattern handle.
+    fn parse_pattern(&self, src: &str) -> PyResult<Pattern> {
+        let inner = self.inner.parse_pattern(src).map_err(to_pyerr)?;
+        Ok(Pattern { inner })
+    }
+
+    /// Parse a STIX bundle JSON string into a Bundle handle.
+    fn parse_bundle(&self, json: &str) -> PyResult<Bundle> {
+        let inner = self.inner.parse_bundle(json).map_err(to_pyerr)?;
+        Ok(Bundle { inner })
+    }
+
+    /// Match a pattern against a bundle.
+    fn match_bundle(&self, pattern: &Pattern, bundle: &Bundle) -> PyResult<MatchResult> {
+        let outcome = self
+            .inner
+            .match_bundle(&pattern.inner, &bundle.inner)
+            .map_err(to_pyerr)?;
+        Ok(MatchResult {
+            matched: outcome.matched,
+            observations: outcome.observations,
+        })
+    }
+
+    /// Register a custom object type. `hook` is a callable `dict -> dict`: it may
+    /// mutate/return the object (adding computed properties) or raise to reject it
+    /// (surfaced as ValidationError from parse_bundle). Runs only at parse time.
+    fn register_type(&mut self, type_name: &str, hook: Py<PyAny>) {
+        self.inner.register_type(
+            type_name,
+            Box::new(move |value: serde_json::Value| {
+                Python::attach(|py| {
+                    // Value -> Python dict
+                    let arg = pythonize::pythonize(py, &value).map_err(|e| e.to_string())?;
+                    // call the Python hook
+                    let result = hook
+                        .call1(py, (arg,))
+                        .map_err(|e| e.value(py).to_string())?;
+                    // returned dict -> Value
+                    let out: serde_json::Value =
+                        pythonize::depythonize(result.bind(py)).map_err(|e| e.to_string())?;
+                    Ok(out)
+                })
+            }),
+        );
+    }
+}

stix_rust-0.1.0/bindings/python/src/errors.rs

@@ -0,0 +1,41 @@
+//! Python exception types and the FfiError -> PyErr mapping.
+use pyo3::create_exception;
+use pyo3::exceptions::PyException;
+use pyo3::prelude::*;
+use stix_ffi::{ErrorCode, FfiError};
+
+create_exception!(
+    _stix,
+    StixError,
+    PyException,
+    "Base class for all stix errors."
+);
+create_exception!(_stix, ParseError, StixError, "Pattern failed to parse.");
+create_exception!(_stix, ModelError, StixError, "Object/bundle import failed.");
+create_exception!(_stix, MatchError, StixError, "Matching failed.");
+create_exception!(
+    _stix,
+    ValidationError,
+    StixError,
+    "A custom-type hook rejected an object."
+);
+
+/// Convert a facade error into the matching Python exception.
+pub fn to_pyerr(err: FfiError) -> PyErr {
+    match err.code {
+        ErrorCode::Parse => ParseError::new_err(err.message),
+        ErrorCode::Model => ModelError::new_err(err.message),
+        ErrorCode::Match => MatchError::new_err(err.message),
+        ErrorCode::Validation => ValidationError::new_err(err.message),
+    }
+}
+
+/// Register the exception types on the module.
+pub fn register(m: &Bound<'_, PyModule>) -> PyResult<()> {
+    m.add("StixError", m.py().get_type::<StixError>())?;
+    m.add("ParseError", m.py().get_type::<ParseError>())?;
+    m.add("ModelError", m.py().get_type::<ModelError>())?;
+    m.add("MatchError", m.py().get_type::<MatchError>())?;
+    m.add("ValidationError", m.py().get_type::<ValidationError>())?;
+    Ok(())
+}

stix_rust-0.1.0/bindings/python/src/handles.rs

@@ -0,0 +1,90 @@
+//! Pyclass handles: Pattern, Bundle, MatchResult.
+use pyo3::prelude::*;
+use pyo3::types::PyList;
+
+/// Parse a JSON string into a native Python object (dict/list/...).
+fn json_to_py(py: Python<'_>, json: &str) -> PyResult<Py<PyAny>> {
+    let value: serde_json::Value = serde_json::from_str(json)
+        .map_err(|e| crate::errors::ParseError::new_err(e.to_string()))?;
+    let obj = pythonize::pythonize(py, &value)
+        .map_err(|e| crate::errors::ModelError::new_err(e.to_string()))?;
+    Ok(obj.unbind())
+}
+
+#[pyclass]
+pub struct Pattern {
+    pub(crate) inner: stix_ffi::Pattern,
+}
+
+#[pymethods]
+impl Pattern {
+    /// The pattern's AST as a native Python dict.
+    #[getter]
+    fn ast(&self, py: Python<'_>) -> PyResult<Py<PyAny>> {
+        json_to_py(py, &self.inner.to_json())
+    }
+
+    fn __repr__(&self) -> String {
+        "Pattern(...)".to_string()
+    }
+}
+
+#[pyclass]
+pub struct Bundle {
+    pub(crate) inner: stix_ffi::Bundle,
+}
+
+#[pymethods]
+impl Bundle {
+    /// Number of objects in the bundle.
+    fn object_count(&self) -> usize {
+        self.inner.object_count()
+    }
+
+    fn __len__(&self) -> usize {
+        self.inner.object_count()
+    }
+
+    /// The object at `index` as a native Python dict, or None if out of range.
+    fn object(&self, py: Python<'_>, index: usize) -> PyResult<Option<Py<PyAny>>> {
+        match self.inner.object_json(index) {
+            Some(json) => Ok(Some(json_to_py(py, &json)?)),
+            None => Ok(None),
+        }
+    }
+
+    /// Iterate over the objects (each a dict).
+    fn __iter__(slf: PyRef<'_, Self>, py: Python<'_>) -> PyResult<Py<PyAny>> {
+        let mut items: Vec<Py<PyAny>> = Vec::with_capacity(slf.inner.object_count());
+        for i in 0..slf.inner.object_count() {
+            if let Some(json) = slf.inner.object_json(i) {
+                items.push(json_to_py(py, &json)?);
+            }
+        }
+        let list = PyList::new(py, items)?;
+        Ok(list.as_any().try_iter()?.into())
+    }
+}
+
+#[pyclass]
+pub struct MatchResult {
+    pub(crate) matched: bool,
+    pub(crate) observations: Vec<u64>,
+}
+
+#[pymethods]
+impl MatchResult {
+    #[getter]
+    fn matched(&self) -> bool {
+        self.matched
+    }
+
+    #[getter]
+    fn observations(&self) -> Vec<u64> {
+        self.observations.clone()
+    }
+
+    fn __bool__(&self) -> bool {
+        self.matched
+    }
+}

stix_rust-0.1.0/bindings/python/src/lib.rs

@@ -0,0 +1,16 @@
+//! Python bindings for the stix-rust toolkit (compiled module `stix._stix`).
+use pyo3::prelude::*;
+
+mod engine;
+mod errors;
+mod handles;
+
+#[pymodule]
+fn _stix(m: &Bound<'_, PyModule>) -> PyResult<()> {
+    errors::register(m)?;
+    m.add_class::<engine::Engine>()?;
+    m.add_class::<handles::Pattern>()?;
+    m.add_class::<handles::Bundle>()?;
+    m.add_class::<handles::MatchResult>()?;
+    Ok(())
+}