After parsing a STIX UTF-8 document Observable's file name is null

[saaguero]

• Library version 1.1.1.2
• The STIX xml document to reproduce this issue is:

<stix:STIX_Package id="mandiant:package-190593d6-1861-4cfe-b212-c016fce1e241" version="1.0.1"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:stix="http://stix.mitre.org/stix-1"
    xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
    xmlns:stixCommon="http://stix.mitre.org/common-1"
    xmlns:cybox="http://cybox.mitre.org/cybox-2"
    xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
    xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
    xmlns:indicator="http://stix.mitre.org/Indicator-2"
    xmlns:ttp="http://stix.mitre.org/TTP-1"
    xmlns:marking="http://data-marking.mitre.org/Marking-1"
    xmlns:simpleMarking="http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1"
    xmlns:mandiant="http://www.mandiant.com"
    xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"

    xsi:schemaLocation="
    http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.0.1/stix_core.xsd
    http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.0.1/stix_default_vocabularies.xsd
    http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.0.1/stix_common.xsd
    http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.0.1/cybox_core.xsd
    http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.0.1/cybox_common.xsd
    http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.0.1/cybox_default_vocabularies.xsd
    http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.0.1/indicator.xsd
    http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.0.1/ttp.xsd
    http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.0.1/data_marking.xsd
    http://data-marking.mitre.org/extensions/MarkingStructure#Simple-1 http://stix.mitre.org/XMLSchema/extensions/marking/simple_marking/1.0.1/simple_marking.xsd
    http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.0.1/File_Object.xsd
    ">
    <stix:STIX_Header>
        <stix:Title>STIX Exploratory UTF κόσμε</stix:Title>
        <stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Package Intent UTF κόσμε</stix:Package_Intent>
        <stix:Description>STIX Exploratory Description UTF κόσμε</stix:Description>
        <stix:Handling>
            <marking:Marking xmlns="http://data-marking.mitre.org">
                <marking:Controlled_Structure>//node()</marking:Controlled_Structure>
                <marking:Marking_Structure xsi:type="simpleMarking:SimpleMarkingStructureType">
                    <simpleMarking:Statement>Statement UTF κόσμε</simpleMarking:Statement>
                </marking:Marking_Structure>
            </marking:Marking>
        </stix:Handling>
        <stix:Information_Source>
            <stixCommon:Identity>
                <stixCommon:Name>Mandiant</stixCommon:Name>
            </stixCommon:Identity>
            <stixCommon:Contributors>
                <stixCommon:Contributor>
                    <stixCommon:Name>MITRE (STIX Conversion) UTF κόσμε</stixCommon:Name>
                </stixCommon:Contributor>
            </stixCommon:Contributors>
        </stix:Information_Source>
    </stix:STIX_Header>

    <stix:Observables cybox_minor_version="0" cybox_major_version="1" cybox_update_version="1">

        <!-- UTF encoding test -->
        <cybox:Observable id="mandiant:observable-f21f0e4b-815a-4520-86e4-8a048e14ff3e">
                <cybox:Object>
                    <cybox:Properties xsi:type="FileObj:FileObjectType">
                        <FileObj:Hashes>
                            <cyboxCommon:Hash>
                                <cyboxCommon:Type>MD5</cyboxCommon:Type>
                                <cyboxCommon:Simple_Hash_Value>481a2f2c588910c21a668c19b63c1138</cyboxCommon:Simple_Hash_Value>
                                <FileObj:File_Name>κόσμε.exe</FileObj:File_Name>
                            </cyboxCommon:Hash>
                        </FileObj:Hashes>
                    </cybox:Properties>
                </cybox:Object>
        </cybox:Observable>
    </stix:Observables>
</stix:STIX_Package>

• Then use the following API to create the corresponding STIXPackage object:

final String stixContent = IOUtils.toString(inputStream, "UTF-8");
final STIXPackage stixPackage = STIXPackage.fromXMLString(stixContent);

• Finally what I get is:
  • stixContent has all the expected UTF-8 strings (titles, file name).
  • stixPackage has only UTF-8 strings for the STIX header xml, but not for the Observabes xml section, particularly filename which equals to null

[nemonik]

Try creating your document via the document model (i.e., the API) and report what you get (as in the XML the model will output.) You'll want to compare the XML the model outputs against your XML above.

[saaguero]

You were right. After using the API I've got the following sample XML which works as expected:

<?xml version="1.0" encoding="UTF-8"?>
<stix:STIX_Package
    id="example:package-25563556-6032-4d7f-8c49-8e6f8d8ec932"
    timestamp="2016-02-02T20:18:48.346Z" version="1.0"
    xmlns="http://xml/metadataSharing.xsd"
    xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
    xmlns:cybox="http://cybox.mitre.org/cybox-2"
    xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
    xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
    xmlns:example="http://example.com/"
    xmlns:indicator="http://stix.mitre.org/Indicator-2"
    xmlns:stix="http://stix.mitre.org/stix-1" xmlns:stixCommon="http://stix.mitre.org/common-1">
    <stix:STIX_Header>
        <stix:Title>Example</stix:Title>
    </stix:STIX_Header>
    <stix:Indicators>
        <stix:Indicator
            id="example:indicator-2d82de4c-5d00-42af-983e-52a13e03fef8"
            timestamp="2016-02-02T20:18:48.346Z"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:type="indicator:IndicatorType">
            <indicator:Title>File Hash Example</indicator:Title>
            <indicator:Observable id="example:observable-f4d03d0c-5861-4a0c-8755-b157a2ad9634">
                <cybox:Object id="example:file-87f06302-2a93-43f7-9131-3d4c287d883c">
                    <cybox:Properties xsi:type="FileObj:FileObjectType">
                        <FileObj:File_Name>κόσμε.exe</FileObj:File_Name>
                        <FileObj:Hashes>
                            <cyboxCommon:Hash>
                                <cyboxCommon:Type xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
                                <cyboxCommon:Simple_Hash_Value>481a2f2c588910c21a668c19b63c1138</cyboxCommon:Simple_Hash_Value>
                            </cyboxCommon:Hash>
                        </FileObj:Hashes>
                    </cybox:Properties>
                </cybox:Object>
            </indicator:Observable>
            <indicator:Producer>
                <stixCommon:Identity>
                    <stixCommon:Name>The MITRE Corporation</stixCommon:Name>
                </stixCommon:Identity>
                <stixCommon:Time>
                    <cyboxCommon:Produced_Time>2016-02-02T20:18:48.346Z</cyboxCommon:Produced_Time>
                </stixCommon:Time>
            </indicator:Producer>
        </stix:Indicator>
    </stix:Indicators>
</stix:STIX_Package>

Closing as not a bug.