Crate stix_pattern 

Lexer and parser for the STIX 2.1 patterning language.

Example

use stix_pattern::parse;

let pattern = parse("[file:hashes.'SHA-256' = 'abc']").unwrap();
let json = serde_json::to_string(&pattern).unwrap();
assert!(json.contains("SHA-256"));

Patterns can also be lowered to a three-address ir::Program and rendered back to canonical pattern text:

use stix_pattern::{ir, parse};

let pattern = parse("[file:size>1024]").unwrap();
let program = ir::lower(&pattern);
assert_eq!(ir::render(&program), "[file:size > 1024]");

Re-exports

pub use error::ParseError;

pub use error::Span;

pub use parser::parse;

pub use parser::MAX_NESTING;

pub use ast::*;

Modules

ast

Abstract syntax tree for STIX 2.1 patterns. All nodes are serde-serializable.

error

Error and source-span types for parsing.

ir

A three-address intermediate representation of a parsed pattern.

lexer

Lexer: converts a pattern string into a flat token stream.

parser

Iterative parser using an explicit stack: tokens -> AST. Nesting is capped at MAX_NESTING.