# Copyright (c) 2017, The MITRE Corporation. All rights reserved.
# See LICENSE.txt for complete terms.
from mixbox import entities
from mixbox import fields
import cybox.bindings.pdf_file_object as pdf_file_binding
from cybox.objects.file_object import File
from cybox.common import (DateTime, HashList, PositiveInteger, String,
NonNegativeInteger, Double, HexBinary, Integer)
[docs]def validate_pdf_object_type(instance, value):
if value is None:
return
elif value in PDFIndirectObject.TYPES:
return
else:
err = "Type must be one of %s. Received '%s'." % (PDFIndirectObject.TYPES, value)
raise ValueError(err)
[docs]def validate_pdf_ref_entry_type(instance, value):
if value is None:
return
elif value in PDFXrefEntry.TYPES:
return
else:
err = "Type must be one of %s. Received '%s'." % (PDFXrefEntry.TYPES, value)
raise ValueError(err)
[docs]def validate_id_string(instance, value):
if value is None:
return
elif len(instance.id_string) >= 2:
err = "ID_String only has a max occurrence of 2."
raise ValueError(err)
else:
return
[docs]class PDFKeywordCount(entities.Entity):
_binding = pdf_file_binding
_binding_class = pdf_file_binding.PDFKeywordCountType
_namespace = 'http://cybox.mitre.org/objects#PDFFileObject-1'
non_obfuscated_count = fields.TypedField("Non_Obfuscated_Count", NonNegativeInteger)
obfuscated_count = fields.TypedField("Obfuscated_Count", NonNegativeInteger)
[docs]class PDFKeywordCounts(entities.Entity):
_binding = pdf_file_binding
_binding_class = pdf_file_binding.PDFKeywordCountsType
_namespace = 'http://cybox.mitre.org/objects#PDFFileObject-1'
page_count = fields.TypedField("Page_Count", PDFKeywordCount)
encrypt_count = fields.TypedField("Encrypt_Count", PDFKeywordCount)
objstm_count = fields.TypedField("ObjStm_Count", PDFKeywordCount)
js_count = fields.TypedField("JS_Count", PDFKeywordCount)
javascript_count = fields.TypedField("JavaScript_Count", PDFKeywordCount)
aa_count = fields.TypedField("AA_Count", PDFKeywordCount)
openaction_count = fields.TypedField("OpenAction_Count", PDFKeywordCount)
asciihexdecode_count = fields.TypedField("ASCIIHexDecode_Count", PDFKeywordCount)
ascii85decode_count = fields.TypedField("ASCII85Decode_Count", PDFKeywordCount)
lzwdecode_count = fields.TypedField("LZWDecode_Count", PDFKeywordCount)
flatedecode_count = fields.TypedField("FlateDecode_Count", PDFKeywordCount)
runlengthdecode_count = fields.TypedField("RunLengthDecode_Count", PDFKeywordCount)
jbig2decode_count = fields.TypedField("JBIG2Decode_Count", PDFKeywordCount)
dctdecode_count = fields.TypedField("DCTDecode_Count", PDFKeywordCount)
richmedia_count = fields.TypedField("RichMedia_Count", PDFKeywordCount)
ccittfaxdecode_count = fields.TypedField("CCITTFaxDecode_Count", PDFKeywordCount)
launch_count = fields.TypedField("Launch_Count", PDFKeywordCount)
xfa_count = fields.TypedField("XFA_Count", PDFKeywordCount)
[docs]class PDFFileID(entities.Entity):
_binding = pdf_file_binding
_binding_class = pdf_file_binding.PDFFileIDType
_namespace = 'http://cybox.mitre.org/objects#PDFFileObject-1'
id_string = fields.TypedField("ID_String", String, multiple=True, preset_hook=validate_id_string)
[docs]class PDFIndirectObjectID(entities.Entity):
_binding = pdf_file_binding
_binding_class = pdf_file_binding.PDFIndirectObjectIDType
_namespace = 'http://cybox.mitre.org/objects#PDFFileObject-1'
object_number = fields.TypedField("Object_Number", PositiveInteger)
generation_number = fields.TypedField("Generation_Number", NonNegativeInteger)
[docs]class PDFDictionary(entities.Entity):
_binding = pdf_file_binding
_binding_class = pdf_file_binding.PDFDictionaryType
_namespace = 'http://cybox.mitre.org/objects#PDFFileObject-1'
# TODO: xs:choice
object_reference = fields.TypedField("Object_Reference", PDFIndirectObjectID)
raw_contents = fields.TypedField("Raw_Contents", String)
[docs]class PDFStream(entities.Entity):
_binding = pdf_file_binding
_binding_class = pdf_file_binding.PDFStreamType
_namespace = 'http://cybox.mitre.org/objects#PDFFileObject-1'
raw_stream = fields.TypedField("Raw_Stream", String)
raw_stream_hashes = fields.TypedField("Raw_Stream_Hashes", HashList)
decoded_stream = fields.TypedField("Decoded_Stream", HexBinary)
decoded_stream_hashes = fields.TypedField("Decoded_Stream_Hashes", HashList)
[docs]class PDFIndirectObjectContents(entities.Entity):
_binding = pdf_file_binding
_binding_class = pdf_file_binding.PDFIndirectObjectContentsType
_namespace = 'http://cybox.mitre.org/objects#PDFFileObject-1'
non_stream_contents = fields.TypedField("Non_Stream_Contents", String)
stream_contents = fields.TypedField("Stream_Contents", PDFStream)
[docs]class PDFIndirectObject(entities.Entity):
_binding = pdf_file_binding
_binding_class = pdf_file_binding.PDFIndirectObjectType
_namespace = 'http://cybox.mitre.org/objects#PDFFileObject-1'
TYPE_BOOLEAN = "Boolean"
TYPE_INTEGER = "Integer"
TYPE_STRING = "String"
TYPE_NAME = "Name"
TYPE_ARRAY = "Array"
TYPE_DICTIONARY = "Dictionary"
TYPE_STREAM = "Stream"
TYPE_NULL = "Null"
TYPES = (TYPE_BOOLEAN, TYPE_INTEGER, TYPE_STRING, TYPE_NAME, TYPE_ARRAY,
TYPE_DICTIONARY, TYPE_STREAM, TYPE_NULL)
type_ = fields.TypedField("type_", key_name="type", preset_hook=validate_pdf_object_type)
id_ = fields.TypedField("ID", PDFIndirectObjectID)
contents = fields.TypedField("Contents", PDFIndirectObjectContents)
offset = fields.TypedField("Offset", PositiveInteger)
hashes = fields.TypedField("Hashes", HashList)
[docs]class PDFIndirectObjectList(entities.EntityList):
_binding = pdf_file_binding
_binding_class = pdf_file_binding.PDFIndirectObjectListType
_namespace = 'http://cybox.mitre.org/objects#PDFFileObject-1'
indirect_object = fields.TypedField("Indirect_Object", PDFIndirectObject, multiple=True)
[docs]class PDFTrailer(entities.Entity):
_binding = pdf_file_binding
_binding_class = pdf_file_binding.PDFTrailerType
_namespace = 'http://cybox.mitre.org/objects#PDFFileObject-1'
size = fields.TypedField("Size", PositiveInteger)
prev = fields.TypedField("Prev", PositiveInteger)
root = fields.TypedField("Root", PDFIndirectObjectID)
encrypt = fields.TypedField("Encrypt", PDFDictionary)
info = fields.TypedField("Info", PDFIndirectObjectID)
id_ = fields.TypedField("ID", PDFFileID)
last_cross_reference_offset = fields.TypedField("Last_Cross_Reference_Offset", PositiveInteger)
offset = fields.TypedField("Offset", PositiveInteger)
hashes = fields.TypedField("Hashes", HashList)
[docs]class PDFTrailerList(entities.EntityList):
_binding = pdf_file_binding
_binding_class = pdf_file_binding.PDFTrailerListType
_namespace = 'http://cybox.mitre.org/objects#PDFFileObject-1'
trailer = fields.TypedField("Trailer", PDFTrailer, multiple=True)
[docs]class PDFXrefEntry(entities.Entity):
_binding = pdf_file_binding
_binding_class = pdf_file_binding.PDFXrefEntryType
_namespace = 'http://cybox.mitre.org/objects#PDFFileObject-1'
TYPE_USE = "In-Use"
TYPE_FREE = "Free"
TYPES = (TYPE_USE, TYPE_FREE)
type_ = fields.TypedField("type_", key_name="type", preset_hook=validate_pdf_ref_entry_type)
# TODO: Byte_Offset and Object_Number xs:choice
byte_offset = fields.TypedField("Byte_Offset", Integer)
object_number = fields.TypedField("Object_Number", NonNegativeInteger)
generation_number = fields.TypedField("Generation_Number", NonNegativeInteger)
[docs]class PDFXrefEntryList(entities.EntityList):
_binding = pdf_file_binding
_binding_class = pdf_file_binding.PDFXrefEntryListType
_namespace = 'http://cybox.mitre.org/objects#PDFFileObject-1'
cross_reference_entry = fields.TypedField("Cross_Reference_Entry", PDFXrefEntry, multiple=True)
[docs]class PDFXrefTableSubsection(entities.Entity):
_binding = pdf_file_binding
_binding_class = pdf_file_binding.PDFXrefTableSubsectionType
_namespace = 'http://cybox.mitre.org/objects#PDFFileObject-1'
first_object_number = fields.TypedField("First_Object_Number", NonNegativeInteger)
number_of_objects = fields.TypedField("Number_Of_Objects", NonNegativeInteger)
cross_reference_entries = fields.TypedField("Cross_Reference_Entries", PDFXrefEntryList)
[docs]class PDFXrefTableSubsectionList(entities.EntityList):
_binding = pdf_file_binding
_binding_class = pdf_file_binding.PDFXrefTableSubsectionListType
_namespace = 'http://cybox.mitre.org/objects#PDFFileObject-1'
subsection = fields.TypedField("Subsection", PDFXrefTableSubsection, multiple=True)
[docs]class PDFXRefTable(entities.Entity):
_binding = pdf_file_binding
_binding_class = pdf_file_binding.PDFXRefTableType
_namespace = 'http://cybox.mitre.org/objects#PDFFileObject-1'
subsections = fields.TypedField("Subsections", PDFXrefTableSubsectionList)
offset = fields.TypedField("Offset", PositiveInteger)
hashes = fields.TypedField("Hashes", HashList)
[docs]class PDFXRefTableList(entities.EntityList):
_binding = pdf_file_binding
_binding_class = pdf_file_binding.PDFXRefTableListType
_namespace = 'http://cybox.mitre.org/objects#PDFFileObject-1'
cross_reference_table = fields.TypedField("Cross_Reference_Table", PDFXRefTable, multiple=True)
[docs]class PDFFile(File):
_binding = pdf_file_binding
_binding_class = pdf_file_binding.PDFFileObjectType
_namespace = 'http://cybox.mitre.org/objects#PDFFileObject-1'
_XSI_NS = "PDFFileObj"
_XSI_TYPE = "PDFFileObjectType"
metadata = fields.TypedField("Metadata", PDFFileMetadata)
version = fields.TypedField("Version", Double)
indirect_objects = fields.TypedField("Indirect_Objects", PDFIndirectObjectList)
cross_reference_tables = fields.TypedField("Cross_Reference_Tables", PDFXRefTableList)
trailers = fields.TypedField("Trailers", PDFTrailerList)