From 567ef5a5ad8c319de9eb0caad97c91d7e19d568e Mon Sep 17 00:00:00 2001
From: Christian Studer <christian.studer@circl.lu>
Date: Wed, 7 Aug 2024 13:21:59 +0200
Subject: [PATCH] fix: [stix2 export] Avoiding issues with EventReport
 referencing attributes or objects exported as Custom STIX 2 Object

- As Event Reports are converted into STIX 2.1 Note
  objects, and we check all the references to existing
  data layer within the Event, some Attributes or
  objects referenced in the Event report might be
  converted to Custom STIX objects
- We have to check if those references are pointing
  to custom objects and add the `allow_custom` flag
  in that case
---
 misp_stix_converter/misp2stix/misp_to_stix21.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/misp_stix_converter/misp2stix/misp_to_stix21.py b/misp_stix_converter/misp2stix/misp_to_stix21.py
index 0cbff06..9dacb05 100644
--- a/misp_stix_converter/misp2stix/misp_to_stix21.py
+++ b/misp_stix_converter/misp2stix/misp_to_stix21.py
@@ -127,6 +127,8 @@ def _parse_event_data(self):
                     list(object_refs) if object_refs
                     else self._handle_empty_note_refs()
                 )
+                if any(ref.startswith('x-misp-') for ref in note_args['object_refs']):
+                    note_args['allow_custom'] = True
                 self._append_SDO(Note(**note_args))
         else:
             self._id_parsing_function = {