codex-admin/autopsy
1
0
Fork 0
mirror of https://github.com/elisspace/autopsy.git synced 2026-09-25 20:17:08 +00:00
Code Issues Releases Wiki Activity

partial substring parent path matching

Browse Source
This commit is contained in:
sidheshenator
2015-03-25 13:01:08 -04:00
parent c26dcc40c6
commit e82fce8622
3 changed files with 41 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java
+15 -2
View File
@@ -22,6 +22,7 @@ import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.UUID;
import java.util.regex.Pattern;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.TskData;
@@ -116,7 +117,7 @@ final class FilesSet {
}
for (Rule rule : rules.values()) {
if (rule.isSatisfied(file)) {
return rule.getName();
return rule.getRuleUUID();
}
}
return null;
@@ -135,6 +136,7 @@ final class FilesSet {
*/
static class Rule {
private final String ruleUUID;
private final String ruleName;
private final FileNameFilter fileNameFilter;
private final MetaTypeFilter metaTypeFilter;
@@ -150,6 +152,10 @@ final class FilesSet {
* @param pathFilter A file path filter, may be null.
*/
Rule(String ruleName, FileNameFilter fileNameFilter, MetaTypeFilter metaTypeFilter, ParentPathFilter pathFilter) {
// since ruleName is optional, ruleUUID can be used to uniquely identify a rule.
this.ruleUUID = UUID.randomUUID().toString();
if (ruleName == null) {
throw new NullPointerException("Interesting files set rule name cannot be null");
}
@@ -231,6 +237,13 @@ final class FilesSet {
return this.ruleName + " (" + fileNameFilter.getTextToMatch() + ")";
}
/**
* @return the ruleUUID
*/
public String getRuleUUID() {
return this.ruleUUID;
}
/**
* An interface for the file attribute filters of which interesting
* files set membership rules are composed.
@@ -581,7 +594,7 @@ final class FilesSet {
*/
@Override
public boolean textMatches(String subject) {
return subject.equalsIgnoreCase(textToMatch);
return Pattern.compile(Pattern.quote(textToMatch), Pattern.CASE_INSENSITIVE).matcher(subject).find();
}
}
Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemDefsManager.java
+24 -6
View File
@@ -32,6 +32,7 @@ import java.util.regex.PatternSyntaxException;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.ParserConfigurationException;
import static org.apache.commons.lang.StringUtils.isBlank;
import org.sleuthkit.autopsy.coreutils.Logger;
import org.sleuthkit.autopsy.coreutils.PlatformUtil;
import org.sleuthkit.autopsy.coreutils.XMLUtil;
@@ -121,6 +122,7 @@ final class InterestingItemDefsManager extends Observable {
private static final String NAME_RULE_TAG = "NAME"; //NON-NLS
private static final String EXTENSION_RULE_TAG = "EXTENSION"; //NON-NLS
private static final String NAME_ATTR = "name"; //NON-NLS
private static final String RULE_UUID_ATTR = "ruleUUID"; //NON-NLS
private static final String DESC_ATTR = "description"; //NON-NLS
private static final String IGNORE_KNOWN_FILES_ATTR = "ignoreKnown"; //NON-NLS
private static final String TYPE_FILTER_ATTR = "typeFilter"; //NON-NLS
@@ -234,10 +236,10 @@ final class InterestingItemDefsManager extends Observable {
Element elem = (Element) nameRuleElems.item(j);
FilesSet.Rule rule = FilesSetXML.readFileNameRule(elem);
if (rule != null) {
if (!rules.containsKey(rule.getName())) {
rules.put(rule.getName(), rule);
if (!rules.containsKey(rule.getRuleUUID())) {
rules.put(rule.getRuleUUID(), rule);
} else {
logger.log(Level.SEVERE, "Found duplicate rule {0} for set named {1} in interesting file sets definition file at {2}, discarding malformed set", new Object[]{rule.getName(), setName, filePath}); // NON-NLS
logger.log(Level.SEVERE, "Found duplicate rule {0} for set named {1} in interesting file sets definition file at {2}, discarding malformed set", new Object[]{rule.getRuleUUID(), setName, filePath}); // NON-NLS
return;
}
} else {
@@ -252,10 +254,10 @@ final class InterestingItemDefsManager extends Observable {
Element elem = (Element) extRuleElems.item(j);
FilesSet.Rule rule = FilesSetXML.readFileExtensionRule(elem);
if (rule != null) {
if (!rules.containsKey(rule.getName())) {
rules.put(rule.getName(), rule);
if (!rules.containsKey(rule.getRuleUUID())) {
rules.put(rule.getRuleUUID(), rule);
} else {
logger.log(Level.SEVERE, "Found duplicate rule {0} for set named {1} in interesting file sets definition file at {2}, discarding malformed set", new Object[]{rule.getName(), setName, filePath}); //NOI18N
logger.log(Level.SEVERE, "Found duplicate rule {0} for set named {1} in interesting file sets definition file at {2}, discarding malformed set", new Object[]{rule.getRuleUUID(), setName, filePath}); //NOI18N
return;
}
} else {
@@ -405,6 +407,17 @@ final class InterestingItemDefsManager extends Observable {
return ruleName;
}
/**
* Read a rule uuid attribute from a rule element.
*
* @param elem A rule element.
* @return A rule name.
*/
private static String readRuleUUID(Element elem) {
// The rule must have a name.
String ruleUUID = elem.getAttribute(FilesSetXML.RULE_UUID_ATTR);
return ruleUUID;
}
/**
* Attempts to compile a regular expression.
*
@@ -517,6 +530,11 @@ final class InterestingItemDefsManager extends Observable {
ruleElement = doc.createElement(FilesSetXML.EXTENSION_RULE_TAG);
}
// Add the rule ID attribute.
if(!isBlank(rule.getRuleUUID())) {
ruleElement.setAttribute(FilesSetXML.RULE_UUID_ATTR, rule.getRuleUUID());
}
// Add the rule name attribute.
ruleElement.setAttribute(FilesSetXML.NAME_ATTR, rule.getName());
Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemDefsPanel.java
+2 -2
View File
@@ -303,7 +303,7 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
// Remove the "old" rule definition and add the new/edited
// definition.
if (selectedRule != null) {
rules.remove(selectedRule.getName());
rules.remove(selectedRule.getRuleUUID());
}
FilesSet.Rule newRule = new FilesSet.Rule(panel.getRuleName(), panel.getFileNameFilter(), panel.getMetaTypeFilter(), panel.getPathFilter());
rules.put(Integer.toString(newRule.hashCode()), newRule);
@@ -725,7 +725,7 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp
FilesSet oldSet = this.setsList.getSelectedValue();
Map<String, FilesSet.Rule> rules = new HashMap<>(oldSet.getRules());
FilesSet.Rule selectedRule = this.rulesList.getSelectedValue();
rules.remove(selectedRule.getName());
rules.remove(selectedRule.getRuleUUID());
this.replaceFilesSet(oldSet, oldSet.getName(), oldSet.getDescription(), oldSet.ignoresKnownFiles(), rules);
}//GEN-LAST:event_deleteRuleButtonActionPerformed