Repository: oasis-open/cti-stix-validator

Issue:
The pattern validator should not be invoked for non-STIX patterns
If the pattern type is snort, the STIX validator will still try to see if it is valid for the STIX Pattern language - which of course it isn't.  We should not output a warning in these cases.

Discussion:

Patch:
diff --git a/stix2validator/v21/musts.py b/stix2validator/v21/musts.py
index 9c71fa9..776adc4 100644
--- a/stix2validator/v21/musts.py
+++ b/stix2validator/v21/musts.py
@@ -408,6 +408,9 @@ def patterns(instance, options):
     if instance['type'] != 'indicator' or 'pattern' not in instance:
         return
 
+    if instance['pattern_type'] != 'stix':
+        return
+
     pattern = instance['pattern']
     if not isinstance(pattern, string_types):
         return  # This error already caught by schemas


Test patch:
diff --git a/stix2validator/test/v21/indicator_tests.py b/stix2validator/test/v21/indicator_tests.py
index 778827c..b45ae39 100644
--- a/stix2validator/test/v21/indicator_tests.py
+++ b/stix2validator/test/v21/indicator_tests.py
@@ -240,3 +240,15 @@ class IndicatorTestCases(ValidatorTest):
         self.assertFalseWithOptions(indicator)
 
         self.check_ignore(indicator, 'indicator-properties')
+
+    def test_indicator_different_pattern_type_does_not_get_validated(self):
+        pattern = ("alert tcp any any <> any 80 (msg:\"SHA256 Alert\";"
+                   " protected_content:\"56D6F32151AD8474F40D7B939C2161EE2BBF10023F4AF1DBB3E13260EBDC6342\";"
+                   " hash:sha256; offset:0; length:4;)")
+        indicator = copy.deepcopy(self.valid_indicator)
+        indicator["pattern"] = pattern
+        indicator["pattern_type"] = "snort"
+        indicator["pattern_version"] = "2.9.15"
+
+        results = validate_parsed_json(indicator, self.options)
+        self.assertEqual(results.is_valid, True)