Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RecursionError on circular reference between Note and Report #465

Open
SYNchroACK opened this issue Sep 28, 2023 · 1 comment
Open

RecursionError on circular reference between Note and Report #465

SYNchroACK opened this issue Sep 28, 2023 · 1 comment
Labels
question use for asking information about a functionality or behavior

Comments

@SYNchroACK
Copy link

SYNchroACK commented Sep 28, 2023

Description

Please understand that this is a dummy example. In real scenario, a potential circular reference can happen and is not against STIX standard (AFAIK) but pycti cannot handle it.

from datetime import datetime

from stix2 import Note, Report, DomainName, Bundle

...

domain = DomainName(value="test.com")
report = Report(name="my report", object_refs=[domain], published=datetime.now())
note = Note(content="my analysis notes", object_refs=[report])

updated_report = report.new_version(object_refs=report.object_refs + [note])

bundle = Bundle(domain, note, updated_report)

self.helper.send_stix2_bundle(
    bundle=bundle.serialize(),
    work_id=work_id,
    update=self.update_existing_data,
)
Traceback (most recent call last):
  File \"/development/marti-opencti/importers/misp/src/connector/base.py\", line 226, in run
    self._run(work_id)
  File \"/development/marti-opencti/importers/misp/src/connector/base.py\", line 300, in _run
    raise error
  File \"/development/marti-opencti/importers/misp/src/connector/base.py\", line 283, in _run
    self.helper.send_stix2_bundle(
  File \"/home/vscode/.local/lib/python3.10/site-packages/pycti/connector/opencti_connector_helper.py\", line 974, in send_stix2_bundle
    bundles = stix2_splitter.split_bundle(bundle, True, event_version)
  File \"/home/vscode/.local/lib/python3.10/site-packages/pycti/utils/opencti_stix2_splitter.py\", line 90, in split_bundle
    self.enlist_element(item[\"id\"], raw_data)
  File \"/home/vscode/.local/lib/python3.10/site-packages/pycti/utils/opencti_stix2_splitter.py\", line 40, in enlist_element
    nb_deps += self.enlist_element(element_ref, raw_data)
  File \"/home/vscode/.local/lib/python3.10/site-packages/pycti/utils/opencti_stix2_splitter.py\", line 40, in enlist_element
    nb_deps += self.enlist_element(element_ref, raw_data)
  File \"/home/vscode/.local/lib/python3.10/site-packages/pycti/utils/opencti_stix2_splitter.py\", line 40, in enlist_element
    nb_deps += self.enlist_element(element_ref, raw_data)
  [Previous line repeated 980 more times]
  File \"/home/vscode/.local/lib/python3.10/site-packages/pycti/utils/opencti_stix2_splitter.py\", line 43, in enlist_element
    elif key.endswith(\"_ref\") and self.is_ref_key_supported(key):
  File \"/home/vscode/.local/lib/python3.10/site-packages/pycti/utils/opencti_stix2_splitter.py\", line 19, in is_ref_key_supported
    def is_ref_key_supported(self, key):
  File \"_pydevd_bundle/pydevd_cython.pyx\", line 1457, in _pydevd_bundle.pydevd_cython.SafeCallWrapper.__call__
RecursionError: maximum recursion depth exceeded while calling a Python object

Environment

  1. PyCTI: 5.9.6
@SamuelHassine SamuelHassine added the question use for asking information about a functionality or behavior label Oct 15, 2023
@Markus98
Copy link

This issue is still present in 5.12.5.

In my case the issue happens when I have a Directory object which has the contains_refs attribute referring to a File object, and that File object has the attribute parent_directory_ref, which points back to the Directory object. This causes a circular reference. As far as I know, this is valid STIX as well but it causes pycti to crash.

Please look into this issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
question use for asking information about a functionality or behavior
Projects
None yet
Development

No branches or pull requests

3 participants