Files
sigma-rules/detection_rules/schemas/stack_compat.py
T
Sergey Polzunov 1fb60d6475 fix: type hinting fixes and additional code checks (#4790)
* first pass

* Adding a dedicated code checking workflow

* Type fixes

* linting config and python version bump

* Type hints

* Drop incorrect config option

* More fixes

* Style fixes

* CI adjustments

* Pyproject fixes

* CI & pyproject fixes

* Proper version bump

* Tests formatting

* Resolve cirtular dependency

* Test fixes

* Make sure the tests are formatted correctly

* Check tweaks

* Bumping python version in CI images

* Pin marshmallow do 3.x because 4.x is not supported

* License fix

* Convert path to str

* Making myself a codeowner

* Missing kwargs param

* Adding a missing kwargs to `set_score`

* Update .github/CODEOWNERS

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

* Dropping unnecessary raise

* Dropping skipped test

* Drop unnecessary var

* Drop unused commented-out func

* Disable typehinting for the whole func

* Update linting command

* Invalid type hist on the input param

* Incorrect field type

* Incorrect value used fix

* Stricter values check

* Simpler function call

* Type condition fix

* TOML formatter fix

* Simpligy output conditions

* Formatting

* Use proper types instead of aliases

* MITRE attack fixes

* Using pathlib.Path for an argument

* Use proper method to update a set from a dict

* First round of `ruff` fixes

* More fixes

* More fixes

* Hack against cyclic dependency

* Ignore `PLC0415`

* Remove unused markers

* Cleanup

* Fixing the incorrect condition

* Update .github/CODEOWNERS

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>

* Set explicit default values for optional fields

* Update the guidelines

* Adding None Defaults

---------

Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com>
Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>
2025-07-01 08:20:55 -05:00

56 lines
2.3 KiB
Python

# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
# or more contributor license agreements. Licensed under the Elastic License
# 2.0; you may not use this file except in compliance with the Elastic License
# 2.0.
from dataclasses import Field
from typing import Any
from semver import Version
from detection_rules.misc import cached
@cached
def get_restricted_field(schema_field: Field[Any]) -> tuple[Version | None, Version | None]:
"""Get an optional min and max compatible versions of a field (from a schema or dataclass)."""
# nested get is to support schema fields being passed directly from dataclass or fields in schema class, since
# marshmallow_dataclass passes the embedded metadata directly
min_compat = schema_field.metadata.get("metadata", schema_field.metadata).get("min_compat")
max_compat = schema_field.metadata.get("metadata", schema_field.metadata).get("max_compat")
min_compat = Version.parse(min_compat, optional_minor_and_patch=True) if min_compat else None
max_compat = Version.parse(max_compat, optional_minor_and_patch=True) if max_compat else None
return min_compat, max_compat
@cached
def get_restricted_fields(schema_fields: list[Field[Any]]) -> dict[str, tuple[Version | None, Version | None]]:
"""Get a list of optional min and max compatible versions of fields (from a schema or dataclass)."""
restricted: dict[str, tuple[Version | None, Version | None]] = {}
for _field in schema_fields:
min_compat, max_compat = get_restricted_field(_field)
if min_compat or max_compat:
restricted[_field.name] = (min_compat, max_compat)
return restricted
@cached
def get_incompatible_fields(
schema_fields: list[Field[Any]],
package_version: Version,
) -> dict[str, tuple[Version | None, Version | None]] | None:
"""Get a list of fields that are incompatible with the package version."""
if not schema_fields:
return None
incompatible: dict[str, tuple[Version | None, Version | None]] = {}
restricted_fields = get_restricted_fields(schema_fields)
for field_name, values in restricted_fields.items():
min_compat, max_compat = values
if (min_compat and package_version < min_compat) or (max_compat and package_version > max_compat):
incompatible[field_name] = (min_compat, max_compat)
return incompatible