[Bug] Fix toml-lint ordering of Mitre metadata #1249 (#1774)

* Order the MITRE metadata by recursively sorting the rule object before writing.

* Refactor order_rule into the rule_formatter module.

* sort test_toml.json according to rule_formatter spec

* rename var to obj since this will traverse all data in the rule

Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>

detection_rules/rule_formatter.py

@@ -7,6 +7,7 @@
 import copy
 import dataclasses
 import io
+import json
 import textwrap
 import typing
 from collections import OrderedDict
@@ -148,6 +149,21 @@ def toml_write(rule_contents, outfile=None):
     contents = copy.deepcopy(rule_contents)
     needs_close = False
 
+    def order_rule(obj):
+        if isinstance(obj, dict):
+            obj = OrderedDict(sorted(obj.items()))
+            for k, v in obj.items():
+                if isinstance(v, dict) or isinstance(v, list):
+                    obj[k] = order_rule(v)
+
+        if isinstance(obj, list):
+            for i, v in enumerate(obj):
+                if isinstance(v, dict) or isinstance(v, list):
+                    obj[i] = order_rule(v)
+            obj = sorted(obj, key=lambda x: json.dumps(x))
+
+        return obj
+
     def _do_write(_data, _contents):
         query = None
 
@@ -203,6 +219,7 @@ def toml_write(rule_contents, outfile=None):
 
         for data in ('metadata', 'rule'):
             _contents = contents.get(data, {})
+            order_rule(_contents)
             _do_write(data, _contents)
 
     finally:

etc/test_toml.json

@@ -63,12 +63,12 @@
       "for": "testing",
       "and": [
         [
-          "nested",
-          "fields"
+          "fields",
+          "nested"
         ],
         [
-          "too",
-          "!"
+          "!",
+          "too"
         ]
       ]
     },
@@ -102,12 +102,12 @@
               "four": {
                 "five": [
                   [
-                    111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111,
-                    2222222222222222222222222222222222222222222222222222222222222222222222222222222222222222,
-                    333333333333333333333333333333333333333333333333333333333333333333
+                    1,
+                    22,
+                    333
                   ],
                   [[4], [5], [6]],
-                  [["seven"], ["nine"], ["eleven"], [12, 13, 14]]
+                  [["a"], ["b"], ["c"], [12, 13, 14]]
                 ]
               }
             }
@@ -116,4 +116,4 @@
       }
     }
   }
-]
+]