[Python3 not supported - v1.1/1.2] to_json vaguely broken on some files

[Rafiot]

tl;rd: python3 support is broken in the version 1.1 and 1.2 of the library.

If the XML file contains a TTP in MAEC format, it is not properly converted back to string, making to_json fail.

Example:
'ttps': {'ttps': [{'behavior': {'malware_instances': [{'maec': b'<stix-maec:MAEC xmlns:stix-maec="http://stix.mitre.org/extensions/Malware#MAEC4.1-1"...

I'm pretty sure this problem will happen in many other cases.

[gtback]

Thanks, @Rafiot. I have no doubts that this is happening, but I'm not sure whether it's something we need to fix in (just) python-stix or also in python-maec. Do you have an example file and code snippet that will reproduce this? That will make it faster for us to add a test case and then fix the underlying bug.

[adulau]

@gtback The files are coming from a well-known ISAC in the Finance sector. Sadly, I cannot share those but it failed in any STIX files in 1.1.1 having the MAEC namespace especially as ttlp:Malware with a maecPackage

[emmanvg]

It looks like the problem is in python-stix: https://github.com/STIXProject/python-stix/blob/master/stix/extensions/malware/maec_4_1_malware.py#L213-L231

Line 226 is forcing xml output directly from the lxml library instead of using mixbox. I expect this to be a simple fix.

[emmanvg]

I can confirm the problem is present in both 1.1.1.X and 1.2.0.X

[gtback]

Thanks for looking into this @emmanvg . @adulau we'll try to get this fixed quickly.

[adulau]

@gtback Thank you for your quick feedback!