diff --git a/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java b/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java index d3c8cc0cc7..be812617bd 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java +++ b/Core/src/org/sleuthkit/autopsy/modules/interestingitems/FilesSet.java @@ -22,6 +22,7 @@ import java.util.ArrayList; import java.util.HashMap; import java.util.List; import java.util.Map; +import java.util.UUID; import java.util.regex.Pattern; import org.sleuthkit.datamodel.AbstractFile; import org.sleuthkit.datamodel.TskData; @@ -116,7 +117,7 @@ final class FilesSet { } for (Rule rule : rules.values()) { if (rule.isSatisfied(file)) { - return rule.getName(); + return rule.getRuleUUID(); } } return null; @@ -135,6 +136,7 @@ final class FilesSet { */ static class Rule { + private final String ruleUUID; private final String ruleName; private final FileNameFilter fileNameFilter; private final MetaTypeFilter metaTypeFilter; @@ -150,6 +152,10 @@ final class FilesSet { * @param pathFilter A file path filter, may be null. */ Rule(String ruleName, FileNameFilter fileNameFilter, MetaTypeFilter metaTypeFilter, ParentPathFilter pathFilter) { + + // since ruleName is optional, ruleUUID can be used to uniquely identify a rule. + this.ruleUUID = UUID.randomUUID().toString(); + if (ruleName == null) { throw new NullPointerException("Interesting files set rule name cannot be null"); } @@ -231,6 +237,13 @@ final class FilesSet { return this.ruleName + " (" + fileNameFilter.getTextToMatch() + ")"; } + /** + * @return the ruleUUID + */ + public String getRuleUUID() { + return this.ruleUUID; + } + /** * An interface for the file attribute filters of which interesting * files set membership rules are composed. @@ -581,7 +594,7 @@ final class FilesSet { */ @Override public boolean textMatches(String subject) { - return subject.equalsIgnoreCase(textToMatch); + return Pattern.compile(Pattern.quote(textToMatch), Pattern.CASE_INSENSITIVE).matcher(subject).find(); } } diff --git a/Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemDefsManager.java b/Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemDefsManager.java index 6980c0ff51..ca791581f4 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemDefsManager.java +++ b/Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemDefsManager.java @@ -32,6 +32,7 @@ import java.util.regex.PatternSyntaxException; import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilderFactory; import javax.xml.parsers.ParserConfigurationException; +import static org.apache.commons.lang.StringUtils.isBlank; import org.sleuthkit.autopsy.coreutils.Logger; import org.sleuthkit.autopsy.coreutils.PlatformUtil; import org.sleuthkit.autopsy.coreutils.XMLUtil; @@ -121,6 +122,7 @@ final class InterestingItemDefsManager extends Observable { private static final String NAME_RULE_TAG = "NAME"; //NON-NLS private static final String EXTENSION_RULE_TAG = "EXTENSION"; //NON-NLS private static final String NAME_ATTR = "name"; //NON-NLS + private static final String RULE_UUID_ATTR = "ruleUUID"; //NON-NLS private static final String DESC_ATTR = "description"; //NON-NLS private static final String IGNORE_KNOWN_FILES_ATTR = "ignoreKnown"; //NON-NLS private static final String TYPE_FILTER_ATTR = "typeFilter"; //NON-NLS @@ -234,10 +236,10 @@ final class InterestingItemDefsManager extends Observable { Element elem = (Element) nameRuleElems.item(j); FilesSet.Rule rule = FilesSetXML.readFileNameRule(elem); if (rule != null) { - if (!rules.containsKey(rule.getName())) { - rules.put(rule.getName(), rule); + if (!rules.containsKey(rule.getRuleUUID())) { + rules.put(rule.getRuleUUID(), rule); } else { - logger.log(Level.SEVERE, "Found duplicate rule {0} for set named {1} in interesting file sets definition file at {2}, discarding malformed set", new Object[]{rule.getName(), setName, filePath}); // NON-NLS + logger.log(Level.SEVERE, "Found duplicate rule {0} for set named {1} in interesting file sets definition file at {2}, discarding malformed set", new Object[]{rule.getRuleUUID(), setName, filePath}); // NON-NLS return; } } else { @@ -252,10 +254,10 @@ final class InterestingItemDefsManager extends Observable { Element elem = (Element) extRuleElems.item(j); FilesSet.Rule rule = FilesSetXML.readFileExtensionRule(elem); if (rule != null) { - if (!rules.containsKey(rule.getName())) { - rules.put(rule.getName(), rule); + if (!rules.containsKey(rule.getRuleUUID())) { + rules.put(rule.getRuleUUID(), rule); } else { - logger.log(Level.SEVERE, "Found duplicate rule {0} for set named {1} in interesting file sets definition file at {2}, discarding malformed set", new Object[]{rule.getName(), setName, filePath}); //NOI18N + logger.log(Level.SEVERE, "Found duplicate rule {0} for set named {1} in interesting file sets definition file at {2}, discarding malformed set", new Object[]{rule.getRuleUUID(), setName, filePath}); //NOI18N return; } } else { @@ -405,6 +407,17 @@ final class InterestingItemDefsManager extends Observable { return ruleName; } + /** + * Read a rule uuid attribute from a rule element. + * + * @param elem A rule element. + * @return A rule name. + */ + private static String readRuleUUID(Element elem) { + // The rule must have a name. + String ruleUUID = elem.getAttribute(FilesSetXML.RULE_UUID_ATTR); + return ruleUUID; + } /** * Attempts to compile a regular expression. * @@ -517,6 +530,11 @@ final class InterestingItemDefsManager extends Observable { ruleElement = doc.createElement(FilesSetXML.EXTENSION_RULE_TAG); } + // Add the rule ID attribute. + if(!isBlank(rule.getRuleUUID())) { + ruleElement.setAttribute(FilesSetXML.RULE_UUID_ATTR, rule.getRuleUUID()); + } + // Add the rule name attribute. ruleElement.setAttribute(FilesSetXML.NAME_ATTR, rule.getName()); diff --git a/Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemDefsPanel.java b/Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemDefsPanel.java index 993039f601..bc8a6a9b64 100755 --- a/Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemDefsPanel.java +++ b/Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemDefsPanel.java @@ -303,7 +303,7 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp // Remove the "old" rule definition and add the new/edited // definition. if (selectedRule != null) { - rules.remove(selectedRule.getName()); + rules.remove(selectedRule.getRuleUUID()); } FilesSet.Rule newRule = new FilesSet.Rule(panel.getRuleName(), panel.getFileNameFilter(), panel.getMetaTypeFilter(), panel.getPathFilter()); rules.put(Integer.toString(newRule.hashCode()), newRule); @@ -725,7 +725,7 @@ final class InterestingItemDefsPanel extends IngestModuleGlobalSettingsPanel imp FilesSet oldSet = this.setsList.getSelectedValue(); Map rules = new HashMap<>(oldSet.getRules()); FilesSet.Rule selectedRule = this.rulesList.getSelectedValue(); - rules.remove(selectedRule.getName()); + rules.remove(selectedRule.getRuleUUID()); this.replaceFilesSet(oldSet, oldSet.getName(), oldSet.getDescription(), oldSet.ignoresKnownFiles(), rules); }//GEN-LAST:event_deleteRuleButtonActionPerformed