Merge pull request #233 from eclecticiq/allow-custom-stix-content-by-…

…default By default the envelope should allow custom properties in STIX object
eclecticiq · Jun 13, 2022 · 8d1bab0 · 8d1bab0
2 parents e0da85c + 8a4487b
commit 8d1bab0
Show file tree

Hide file tree

Showing 8 changed files with 178 additions and 7 deletions.
diff --git a/CHANGES.rst b/CHANGES.rst
@@ -1,6 +1,10 @@
 Changelog
 =========
 
+0.9.0 (????-??-??)
+------------------
+* Allow custom properties. This can be disabled by config option ``allow_custom_properties``
+
 0.8.0 (2022-06-05)
 ------------------
 * Nest details inside taxii2 job and allow counts without details

diff --git a/docs/configuration.rst b/docs/configuration.rst
@@ -121,6 +121,7 @@ Properties
           - ``create_tables`` — boolean, if true, create tables on startup
 
       - ``max_content_length`` — the maximum size of the request body in bytes that the server can support
+      - ``allow_custom_properties`` — boolean, if true, allow custom stix2 properties when posting objects (default: true)
 
     - ``logging`` — logging configuration.
 

diff --git a/opentaxii/_version.py b/opentaxii/_version.py
@@ -3,4 +3,4 @@
 This module defines the package version for use in __init__.py and setup.py.
 """
 
-__version__ = '0.8.0'
+__version__ = '0.9.0'
diff --git a/opentaxii/config.py b/opentaxii/config.py
@@ -63,6 +63,7 @@ class ServerConfig(dict):
         "max_content_length",
         "title",
         "public_discovery",
+        "allow_custom_properties",
     )
     ALL_VALID_OPTIONS = VALID_BASE_OPTIONS + VALID_TAXII_OPTIONS + VALID_TAXII1_OPTIONS
 

diff --git a/opentaxii/server.py b/opentaxii/server.py
@@ -674,7 +674,9 @@ def objects_get_handler(self, api_root_id, collection_id_or_alias):
         )
 
     def objects_post_handler(self, api_root_id, collection_id_or_alias):
-        validate_envelope(request.data)
+        validate_envelope(
+            request.data, allow_custom=self.config.get("allow_custom_properties", True)
+        )
         try:
             job = self.persistence.add_objects(
                 api_root_id=api_root_id,