6172: Validation of correlation attribute value not happening correctly

InternalPythonModules/android/calllog.py

@@ -105,6 +105,9 @@ class CallLogAnalyzer(general.AndroidComponentAnalyzer):
                                         timeStamp = resultSet.getLong("date") / 1000
                                          
                                         number = resultSet.getString("number")
+                                        if not general.isValidPhoneNumer(number):
+                                            number = None
+                                            
                                         duration = resultSet.getLong("duration") # duration of call is in seconds
                                         name = resultSet.getString("name") # name of person dialed or called. None if unregistered
 

InternalPythonModules/android/general.py

@@ -1,7 +1,7 @@
 """
 Autopsy Forensic Browser
 
-Copyright 2016 Basis Technology Corp.
+Copyright 2016-2020 Basis Technology Corp.
 Contact: carrier <at> sleuthkit <dot> org
 
 Licensed under the Apache License, Version 2.0 (the "License");
@@ -15,8 +15,11 @@ distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
+
 """
 
+import re
+
 MODULE_NAME = "Android Analyzer"
 
 """
@@ -37,3 +40,15 @@ def appendAttachmentList(msgBody, attachmentsList):
         body = body + "\n".join(list(filter(None, attachmentsList)))
 
     return body
+
+"""
+Checks if the given string might be a phone number.
+"""
+def isValidPhoneNumer(data):
+    return bool(re.match(r"^\+?[0-9()\-\s]+$", data))
+
+"""
+Checks if the given string is a valid email address.
+"""
+def isValidEmailAddress(data):
+    return bool(re.match(r"(^[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+$)", data))

InternalPythonModules/android/textnow.py

@@ -109,13 +109,21 @@ class TextNowAnalyzer(general.AndroidComponentAnalyzer):
         try:
             contacts_parser = TextNowContactsParser(textnow_db)
             while contacts_parser.next():
-                helper.addContact( 
-                    contacts_parser.get_contact_name(), 
-                    contacts_parser.get_phone(),
-                    contacts_parser.get_home_phone(),
-                    contacts_parser.get_mobile_phone(),
-                    contacts_parser.get_email()
-                )
+                name = contacts_parser.get_contact_name()
+                phone = contacts_parser.get_phone()
+                home_phone = contacts_parser.get_home_phone()
+                mobile_phone = contacts_parser.get_mobile_phone()
+                email = contacts_parser.get_email()
+
+                # add contact if we have at least one valid phone/email
+                if phone or home_phone or mobile_phone or email:
+                    helper.addContact( 
+                        name, 
+                        phone,
+                        home_phone,
+                        mobile_phone,
+                        email
+                    )
             contacts_parser.close()
         except SQLException as ex:
             #Error parsing TextNow db
@@ -277,7 +285,13 @@ class TextNowContactsParser(TskContactsParser):
         return self.result_set.getString("name")
     
     def get_phone(self):
-        return self.result_set.getString("number")
+        number = self.result_set.getString("number")
+        return (number if general.isValidPhoneNumer(number) else None)
+        
+    def get_email(self):
+        # occasionally the 'number' column may have an email address instead
+        value = self.result_set.getString("number")
+        return (value if general.isValidEmailAddress(value) else None)
 
 class TextNowMessagesParser(TskMessagesParser):
     """

InternalPythonModules/android/whatsapp.py

@@ -172,14 +172,22 @@ class WhatsAppAnalyzer(general.AndroidComponentAnalyzer):
         try:
             contacts_parser = WhatsAppContactsParser(contacts_db, self._PARSER_NAME)
             while contacts_parser.next():
-                helper.addContact( 
-                    contacts_parser.get_contact_name(), 
-                    contacts_parser.get_phone(),
-                    contacts_parser.get_home_phone(),
-                    contacts_parser.get_mobile_phone(),
-                    contacts_parser.get_email(),
-                    contacts_parser.get_other_attributes()
-                )
+                name = contacts_parser.get_contact_name()
+                phone = contacts_parser.get_phone()
+                home_phone = contacts_parser.get_home_phone()
+                mobile_phone = contacts_parser.get_mobile_phone()
+                email = contacts_parser.get_email()
+
+                # add contact if we have at least one valid phone/email
+                if phone or home_phone or mobile_phone or email:
+                    helper.addContact( 
+                        name, 
+                        phone,
+                        home_phone,
+                        mobile_phone,
+                        email,
+                        contacts_parser.get_other_attributes()
+                    )
             contacts_parser.close()
         except SQLException as ex:
             self._logger.log(Level.WARNING, "Error querying the whatsapp database for contacts.", ex)
@@ -426,8 +434,14 @@ class WhatsAppContactsParser(TskContactsParser):
         return self.result_set.getString("name")
 
     def get_phone(self):
-        return self.result_set.getString("number")
+        number = self.result_set.getString("number")
+        return (number if general.isValidPhoneNumer(number) else None)
 
+    def get_email(self):
+        # occasionally the 'number' column may have an email address instead
+        value = self.result_set.getString("number")
+        return (value if general.isValidEmailAddress(value) else None)
+        
     def get_other_attributes(self):
         return [BlackboardAttribute(
                     BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ID,