From 860287b087331a6420097720042f5f19ebb4995f Mon Sep 17 00:00:00 2001
From: Jeremy Cloarec <jeremy.cloarec@filigran.io>
Date: Fri, 20 Jun 2025 16:35:23 +0200
Subject: [PATCH] [client] fix handling of None values for externalReferences
 and killChainPhases

---
 pycti/utils/opencti_stix2.py          | 25 ++++++++++++++++++++-----
 pycti/utils/opencti_stix2_splitter.py |  4 ++--
 2 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/pycti/utils/opencti_stix2.py b/pycti/utils/opencti_stix2.py
index 9b2eedcb1..860427d48 100644
--- a/pycti/utils/opencti_stix2.py
+++ b/pycti/utils/opencti_stix2.py
@@ -420,7 +420,10 @@ def extract_embedded_relationships(
             stix_object["kill_chain_phases"] = self.opencti.get_attribute_in_extension(
                 "kill_chain_phases", stix_object
             )
-        if "kill_chain_phases" in stix_object:
+        if (
+            "kill_chain_phases" in stix_object
+            and stix_object["kill_chain_phases"] is not None
+        ):
             for kill_chain_phase in stix_object["kill_chain_phases"]:
                 if (
                     kill_chain_phase["kill_chain_name"] + kill_chain_phase["phase_name"]
@@ -463,7 +466,10 @@ def extract_embedded_relationships(
                         "type": kill_chain_phase["entity_type"],
                     }
                 kill_chain_phases_ids.append(kill_chain_phase["id"])
-        elif "x_opencti_kill_chain_phases" in stix_object:
+        elif (
+            "x_opencti_kill_chain_phases" in stix_object
+            and stix_object["x_opencti_kill_chain_phases"] is not None
+        ):
             for kill_chain_phase in stix_object["x_opencti_kill_chain_phases"]:
                 if (
                     kill_chain_phase["kill_chain_name"] + kill_chain_phase["phase_name"]
@@ -525,7 +531,10 @@ def extract_embedded_relationships(
                     "external_references", stix_object
                 )
             )
-        if "external_references" in stix_object:
+        if (
+            "external_references" in stix_object
+            and stix_object["external_references"] is not None
+        ):
             for external_reference in stix_object["external_references"]:
                 try:
                     url = (
@@ -706,7 +715,10 @@ def extract_embedded_relationships(
                     self.opencti.app_logger.warning(
                         "Cannot generate external reference"
                     )
-        elif "x_opencti_external_references" in stix_object:
+        elif (
+            "x_opencti_external_references" in stix_object
+            and stix_object["x_opencti_external_references"] is not None
+        ):
             for external_reference in stix_object["x_opencti_external_references"]:
                 url = external_reference["url"] if "url" in external_reference else None
                 source_name = (
@@ -775,7 +787,10 @@ def extract_embedded_relationships(
             granted_refs_ids = self.opencti.get_attribute_in_extension(
                 "granted_refs", stix_object
             )
-        elif "x_opencti_granted_refs" in stix_object:
+        elif (
+            "x_opencti_granted_refs" in stix_object
+            and stix_object["x_opencti_granted_refs"] is not None
+        ):
             granted_refs_ids = stix_object["x_opencti_granted_refs"]
         # Sample refs
         sample_refs_ids = (
diff --git a/pycti/utils/opencti_stix2_splitter.py b/pycti/utils/opencti_stix2_splitter.py
index be64ccd5f..2d50f299f 100644
--- a/pycti/utils/opencti_stix2_splitter.py
+++ b/pycti/utils/opencti_stix2_splitter.py
@@ -123,7 +123,7 @@ def enlist_element(
                 else:
                     item[key] = None
             # Case for embedded elements (deduplicating and cleanup)
-            elif key == "external_references":
+            elif key == "external_references" and item[key] is not None:
                 # specific case of splitting external references
                 # reference_ids = []
                 deduplicated_references = []
@@ -149,7 +149,7 @@ def enlist_element(
                         #     reference_ids.append(reference_id)
                         # nb_deps += self.enlist_element(reference_id, raw_data)
                 item[key] = deduplicated_references
-            elif key == "kill_chain_phases":
+            elif key == "kill_chain_phases" and item[key] is not None:
                 # specific case of splitting kill_chain phases
                 # kill_chain_ids = []
                 deduplicated_kill_chain = []