Namespace not found: http://xml/metadataSharing.xsd

[chehsunliu]

We have an internal project using both Java and Python with their corresponding latest STIX libraries for STIX 1.1.1. When an XML document is generated using the following Java code:

import org.mitre.stix.stix_1.STIXPackage;

public class Hello {
    public static void main(String[] args) {
        System.out.println(new STIXPackage().withVersion("1.1.1").toXMLString(true));
    }
}

there is always a line http://xml/metadataSharing.xsd in it:

<?xml version="1.0" encoding="UTF-8"?>
<stix:STIX_Package version="1.1.1"
    xmlns="http://xml/metadataSharing.xsd" xmlns:stix="http://stix.mitre.org/stix-1"/>

The schema exists in the official document. The XML document can also pass the validation (STIX Document Validator v2.5.0):

$ cat ./test1.xml
<?xml version="1.0" encoding="UTF-8"?>
<stix:STIX_Package version="1.1.1"
    xmlns="http://xml/metadataSharing.xsd" xmlns:stix="http://stix.mitre.org/stix-1"/>
$ stix-validator.py --stix-version 1.1.1 ./test1.xml
[-] Performing xml schema validation on ./test1.xml
================================================================================
[-] Results: ./test1.xml
[+] XML Schema: True

However, for the following Python program:

import sys

from stix.core import STIXPackage


def main():
    pkg = STIXPackage.from_xml(sys.argv[1])
    print(pkg.to_xml().decode())


if __name__ == '__main__':
    main()

it failed:

$ ./venv/bin/python ./test.py ./test1.xml
Traceback (most recent call last):
  File "/Users/chehsunliu/testzone/python/test/venv/lib/python3.6/site-packages/mixbox/namespaces.py", line 205, in __lookup_uri
    return self.__ns_uri_map[uri]
KeyError: 'http://xml/metadataSharing.xsd'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "./test.py", line 14, in <module>
    main()
  File "./test.py", line 10, in main
    print(pkg.to_xml().decode())
  File "/Users/chehsunliu/testzone/python/test/venv/lib/python3.6/site-packages/stix/base.py", line 142, in to_xml
    ns_info.finalize(ns_dict=ns_dict, schemaloc_dict=schemaloc_dict)
  File "/Users/chehsunliu/testzone/python/test/venv/lib/python3.6/site-packages/mixbox/entities.py", line 903, in finalize
    self._finalize_namespaces(ns_dict)
  File "/Users/chehsunliu/testzone/python/test/venv/lib/python3.6/site-packages/mixbox/entities.py", line 847, in _finalize_namespaces
    prefix = namespaces.lookup_name(ns_uri)
  File "/Users/chehsunliu/testzone/python/test/venv/lib/python3.6/site-packages/mixbox/namespaces.py", line 859, in lookup_name
    return __ALL_NAMESPACES.preferred_prefix_for_namespace(ns_uri)
  File "/Users/chehsunliu/testzone/python/test/venv/lib/python3.6/site-packages/mixbox/namespaces.py", line 291, in preferred_prefix_for_namespace
    ni = self.__lookup_uri(ns_uri)
  File "/Users/chehsunliu/testzone/python/test/venv/lib/python3.6/site-packages/mixbox/namespaces.py", line 207, in __lookup_uri
    raise NamespaceNotFoundError(uri)
mixbox.namespaces.NamespaceNotFoundError: Namespace not found: http://xml/metadataSharing.xsd

[gtback]

Hi, @chehsunliu . Thanks for the really detailed report. It definitely seems like a bug in the Java STIX library to be including xmlns="http://xml/metadataSharing.xsd" on an empty STIX Package. But as a workaround, you should be able to register the namespace manually. Something like this:

from mixbox.namespaces import Namespace, register_namespace
register_namespace(Namespace("http://xml/metadataSharing.xsd", "metadataSharing", "http://grouper.ieee.org/groups/malware/malwg/Schema1.2/metadataSharing.xsd"))

That was enough for me to get your test script to work, but you may run into other problems. If so, let me know.

Are you using MAEC for anything?

cc: @ikiril01 @nemonik

[gtback]

I'm going to close this, since I don't think we want to change anything in python-stix about how this works. I'm open to reconsidering if I'm missing something, though.

Thanks again, @chehsunliu !