Skip to content

Improve documentation around "original_text" vs. "text" variables #247

Description

@fhightower

We should clarify the purpose of the original_text` variable.

  • make original_text a constant?
  • Add docs/comment noting why we parse from original_text to find some ioc types while others are parsed from text

Here's an explanation of the diff between the two variables I shared in another context:

Why are some IOC types are pulled from "original_text" while others are pulled from "text"? The "original_text" points to a string which remains unmodified throughout the code while the "text" variable points to a string which can be modified (e.g. it may have URLs removed from it). When parsing some values, like CVEs, we choose to parse from "original_text" because we want to parse CVEs from URLs even if URLs were removed from the "text" variable. Basically, any IOC data which has a standard (e.g. CVEs or TLDs) is parsed from original_text b/c we want to parse such IOC data from URLs.

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions