STIX Patterning language needs intra-list matching capability

[treyka]

No description provided.

[ikiril01]

This is definitely something that we need to fix, as users are encountering this issue. Here's the draft text we've proposed:

"The literal 's' indicates that, when evaluating two or more AND'd Comparison Expressions that contain a list-based object path, that the Boolean expression MUST evaluate to true if there is an s that allows the AND'd Comparison Expressions to be true, otherwise false"

[gtback]

I'm okay with this change, even though it does make code to evaluate patterns more complex (despite the relatively minor change to the grammar).

I don't think this should be considered a "bug" that needs to be "fixed", though. It's additional functionality, and was a known limitation at the time the current list-item-matching construct was added.

[ikiril01]

I think this was something we overlooked when adding the existing list-item-matching construct. So maybe not quite a bug, but it's something that should have been in there ;)

[treyka]

@samcornwell points out this related CAR proposal

[jmgnc]

We could possibly solve the multi vars by restricting it to parenthesized expressions:
([s] != 'a' and [s] = 'b') AND ([s] = 'c' and [s] = 'd')

Sam brought up the case of wanting to do an or for one part of it, such as:
([s] = 'a' or [s] = 'b') and [s] = c

This may be valid per the existing text, as ([s] = 'a' or [s] = 'b') is a comparison expression, and so therefor should work.

[jordan2175]

We talked about this 2019-06-05 and Jason says this is super important and that he will propose some text in the document.