codex-admin/autopsy
1
0
Fork 0
mirror of https://github.com/elisspace/autopsy.git synced 2026-10-01 23:09:56 +00:00
Code Issues Releases Wiki Activity

bug fixes for testing exceptions and notes

Browse Source
This commit is contained in:
Brian Sweeney
2018-06-01 12:28:04 -06:00
parent 2156daec4d
commit a7e69d8fb5
3 changed files with 65 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/AbstractSqlEamDb.java
+59 -57
View File
@@ -673,74 +673,76 @@ public abstract class AbstractSqlEamDb implements EamDb {
if (correlationCase != null) {
singleCase = true;
}
if (values == null) {
values = new ArrayList<String>();
}
Connection conn = connect();
List<CorrelationAttributeCommonInstance> artifactInstances = new ArrayList<>();
if (values != null && !values.isEmpty()) {
//we can skip all this if there is nothing to search for
String tableName = EamDbUtil.correlationTypeToInstanceTableName(aType);
StringBuilder sql = new StringBuilder(10);
sql.append("SELECT cases.case_name, cases.case_uid, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id, value FROM ");
sql.append(tableName);
sql.append(" LEFT JOIN cases ON ");
sql.append(tableName);
sql.append(".case_id=cases.id");
sql.append(" LEFT JOIN data_sources ON ");
sql.append(tableName);
sql.append(".data_source_id=data_sources.id");
sql.append(" WHERE value IN (SELECT value FROM ");
sql.append(tableName);
sql.append(" WHERE value IN (");
// SELECT cases.case_name, cases.case_uid, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id, value FROM file_instances LEFT JOIN cases ON file_instances.case_id=cases.id LEFT JOIN data_sources ON file_instances.data_source_id=data_sources.id WHERE value IN (SELECT value FROM file_instances WHERE value IN ("59029becd7f830c0478aeb5e67cc3b20","d2b949c51cf3d5721699a6ea500eeba7","b90c8c8fb1c4687780002704b59585fe") GROUP BY value HAVING COUNT(*) > 1) ORDER BY value
CorrelationAttributeCommonInstance artifactInstance;
PreparedStatement preparedStatement = null;
ResultSet resultSet = null;
// Note: PreparedStatement has a limit on ? variable replacement so instead query is built with values appended directly into the string
for (String value : values) {
sql.append("'");
sql.append(value);
sql.append("',");
}
String tableName = EamDbUtil.correlationTypeToInstanceTableName(aType);
StringBuilder sql = new StringBuilder(10);
sql.append("SELECT cases.case_name, cases.case_uid, data_sources.name, device_id, file_path, known_status, comment, data_sources.case_id, value FROM ");
sql.append(tableName);
sql.append(" LEFT JOIN cases ON ");
sql.append(tableName);
sql.append(".case_id=cases.id");
sql.append(" LEFT JOIN data_sources ON ");
sql.append(tableName);
sql.append(".data_source_id=data_sources.id");
sql.append(" WHERE value IN (SELECT value FROM ");
sql.append(tableName);
sql.append(" WHERE value IN (");
// Note: PreparedStatement has a limit on ? variable replacement so instead query is built with values appended directly into the string
for (String value : values) {
sql.append("'");
sql.append(value);
sql.append("',");
}
if (values != null) {
sql.deleteCharAt(sql.length() - 1);
}
sql.append(") GROUP BY value HAVING COUNT(*) > 1)"); //
if (singleCase && correlationCase != null) {
sql.append(" AND ");
sql.append(tableName);
sql.append(".case_id=?");
sql.append(" OR ");
sql.append(tableName);
sql.append(".case_id=?");
sql.append(") GROUP BY value HAVING COUNT(*) > 1)"); //
}
sql.append(" ORDER BY value, cases.case_name, file_path");
try {
preparedStatement = conn.prepareStatement(sql.toString());
if (singleCase && correlationCase != null) {
preparedStatement.setInt(1, correlationCase.getID());
preparedStatement.setInt(2, currentCaseId);
sql.append(" AND ");
sql.append(tableName);
sql.append(".case_id=?");
sql.append(" OR ");
sql.append(tableName);
sql.append(".case_id=?");
}
//TODO shows extra results - possibly shows matches within current case
resultSet = preparedStatement.executeQuery();
while (resultSet.next()) {
artifactInstance = getCommonEamArtifactInstanceFromResultSet(resultSet);
artifactInstances.add(artifactInstance);
sql.append(" ORDER BY value, cases.case_name, file_path");
Connection conn = connect();
CorrelationAttributeCommonInstance artifactInstance;
PreparedStatement preparedStatement = null;
ResultSet resultSet = null;
try {
preparedStatement = conn.prepareStatement(sql.toString());
if (singleCase && correlationCase != null) {
preparedStatement.setInt(1, correlationCase.getID());
preparedStatement.setInt(2, currentCaseId);
}
resultSet = preparedStatement.executeQuery();
while (resultSet.next()) {
artifactInstance = getCommonEamArtifactInstanceFromResultSet(resultSet);
artifactInstances.add(artifactInstance);
}
} catch (SQLException ex) {
throw new EamDbException("Error getting artifact instances by artifactType and artifactValue.", ex); // NON-NLS
} finally {
EamDbUtil.closePreparedStatement(preparedStatement);
EamDbUtil.closeResultSet(resultSet);
EamDbUtil.closeConnection(conn);
}
} catch (SQLException ex) {
throw new EamDbException("Error getting artifact instances by artifactType and artifactValue.", ex); // NON-NLS
} finally {
EamDbUtil.closePreparedStatement(preparedStatement);
EamDbUtil.closeResultSet(resultSet);
EamDbUtil.closeConnection(conn);
}
return artifactInstances;
Core/src/org/sleuthkit/autopsy/centralrepository/datamodel/EamDb.java
+2
View File
@@ -230,8 +230,10 @@ public interface EamDb {
*
* @param correlationCase Case id to search on
* @param values List of ArtifactInstance MD5 values to find matches of.
* @param currentCaseId current case
*
* @return List of artifact instances for a given list of MD5 values
* //TODO create an overload that omits the case params
*/
List<CorrelationAttributeCommonInstance> getArtifactInstancesByCaseValues(CorrelationCase correlationCase, Collection<String> values, int currentCaseId) throws EamDbException;
Core/test/qa-functional/src/org/sleuthkit/autopsy/centralrepository/datamodel/CentralRepoDatamodelTest.java
+4 -4
View File
@@ -845,7 +845,7 @@ public class CentralRepoDatamodelTest extends TestCase {
// Test getting common instances with expected results
try {
List<CorrelationAttributeCommonInstance> instances = EamDb.getInstance().getArtifactInstancesByCaseValues(null, Arrays.asList(inAllDataSourcesHash, inDataSource1twiceHash));
List<CorrelationAttributeCommonInstance> instances = EamDb.getInstance().getArtifactInstancesByCaseValues(null, Arrays.asList(inAllDataSourcesHash, inDataSource1twiceHash), -1);
assertTrue("getArtifactInstancesByCaseValues returned " + instances.size() + " results - expected 5", instances.size() == 5);
// This test works because all the instances of this hash were set to the same path
@@ -867,7 +867,7 @@ public class CentralRepoDatamodelTest extends TestCase {
// Test getting instances expecting no results because they are not in the case
try {
CorrelationCase badCase = new CorrelationCase("badCaseUuid", "badCaseName");
List<CorrelationAttributeCommonInstance> instances = EamDb.getInstance().getArtifactInstancesByCaseValues(badCase, Arrays.asList(inAllDataSourcesHash, inDataSource1twiceHash));
List<CorrelationAttributeCommonInstance> instances = EamDb.getInstance().getArtifactInstancesByCaseValues(badCase, Arrays.asList(inAllDataSourcesHash, inDataSource1twiceHash), 0);
assertTrue("getArtifactInstancesByTypeValue returned " + instances.size() + " results - expected 0", instances.isEmpty());
} catch (EamDbException ex) {
@@ -878,7 +878,7 @@ public class CentralRepoDatamodelTest extends TestCase {
// Test getting instances expecting no results because of bad hashes
try {
List<CorrelationAttributeCommonInstance> instances = EamDb.getInstance().getArtifactInstancesByCaseValues(null, Arrays.asList("xyz", "123"));
List<CorrelationAttributeCommonInstance> instances = EamDb.getInstance().getArtifactInstancesByCaseValues(null, Arrays.asList("xyz", "123"), -1);
assertTrue("getArtifactInstancesByTypeValue returned " + instances.size() + " results - expected 0", instances.isEmpty());
} catch (EamDbException ex) {
@@ -918,7 +918,7 @@ public class CentralRepoDatamodelTest extends TestCase {
// Test getting instances with null value
// Should just return nothing
try {
List<CorrelationAttributeCommonInstance> instances = EamDb.getInstance().getArtifactInstancesByCaseValues(null, null);
List<CorrelationAttributeCommonInstance> instances = EamDb.getInstance().getArtifactInstancesByCaseValues(null, null, -1);
assertTrue("getArtifactInstancesByTypeValue returned non-empty list for null value", instances.isEmpty());
} catch (EamDbException ex) {