def testGlobAndGroup(self):
filepaths = [
("foo", "bar", "0"),
("foo", "bar", "1"),
("foo", "baz", "0"),
("foo", "baz", "1"),
("foo", "quux", "0"),
("foo", "quux", "1"),
]
with DirHierarchy(filepaths) as hierarchy:
path = hierarchy(("foo", "ba{r,z}", "*"))
results = list(globbing.ExpandPath(path))
self.assertCountEqual(results, [
hierarchy(("foo", "bar", "0")),
hierarchy(("foo", "bar", "1")),
hierarchy(("foo", "baz", "0")),
hierarchy(("foo", "baz", "1")),
])
path = hierarchy(("foo", "ba*", "{0,1}"))
results = list(globbing.ExpandPath(path))
self.assertCountEqual(results, [
hierarchy(("foo", "bar", "0")),
hierarchy(("foo", "bar", "1")),
hierarchy(("foo", "baz", "0")),
hierarchy(("foo", "baz", "1")),
])
def testRecursiveAndGroup(self):
filepaths = [
("foo", "0"),
("foo", "1"),
("foo", "bar", "0"),
("foo", "baz", "quux", "0"),
]
with DirHierarchy(filepaths) as hierarchy:
path = hierarchy(("foo", "**"))
results = list(globbing.ExpandPath(path))
self.assertCountEqual(results, [
hierarchy(("foo", "0")),
hierarchy(("foo", "1")),
hierarchy(("foo", "bar")),
hierarchy(("foo", "baz")),
hierarchy(("foo", "bar", "0")),
hierarchy(("foo", "baz", "quux")),
hierarchy(("foo", "baz", "quux", "0")),
])
path = hierarchy(("foo", "{.,**}"))
results = list(globbing.ExpandPath(path))
self.assertCountEqual(results, [
hierarchy(("foo", )),
hierarchy(("foo", "0")),
hierarchy(("foo", "1")),
hierarchy(("foo", "bar")),
hierarchy(("foo", "baz")),
hierarchy(("foo", "bar", "0")),
hierarchy(("foo", "baz", "quux")),
hierarchy(("foo", "baz", "quux", "0")),
])
def testRecursiveAndGroup(self):
self.Touch("foo", "0")
self.Touch("foo", "1")
self.Touch("foo", "bar", "0")
self.Touch("foo", "baz", "quux", "0")
path = self.Path("foo/**")
results = list(globbing.ExpandPath(path))
self.assertCountEqual(results, [
self.Path("foo", "0"),
self.Path("foo", "1"),
self.Path("foo", "bar"),
self.Path("foo", "baz"),
self.Path("foo", "bar", "0"),
self.Path("foo", "baz", "quux"),
self.Path("foo", "baz", "quux", "0"),
])
path = self.Path("foo/{.,**}")
results = list(globbing.ExpandPath(path))
self.assertCountEqual(results, [
self.Path("foo"),
self.Path("foo", "0"),
self.Path("foo", "1"),
self.Path("foo", "bar"),
self.Path("foo", "baz"),
self.Path("foo", "bar", "0"),
self.Path("foo", "baz", "quux"),
self.Path("foo", "baz", "quux", "0"),
])
def testGlobAndGroup(self):
self.Touch("foo", "bar", "0")
self.Touch("foo", "bar", "1")
self.Touch("foo", "baz", "0")
self.Touch("foo", "baz", "1")
self.Touch("foo", "quux", "0")
self.Touch("foo", "quux", "1")
path = self.Path("foo/ba{r,z}/*")
results = list(globbing.ExpandPath(path))
self.assertCountEqual(results, [
self.Path("foo", "bar", "0"),
self.Path("foo", "bar", "1"),
self.Path("foo", "baz", "0"),
self.Path("foo", "baz", "1"),
])
path = self.Path("foo/ba*/{0,1}")
results = list(globbing.ExpandPath(path))
self.assertCountEqual(results, [
self.Path("foo", "bar", "0"),
self.Path("foo", "bar", "1"),
self.Path("foo", "baz", "0"),
self.Path("foo", "baz", "1"),
])
def GetExpandedPaths(
args: rdf_file_finder.FileFinderArgs,
heartbeat_cb: Callable[[], None] = _NoOp) -> Iterator[Text]:
"""Expands given path patterns.
Args:
args: A `FileFinderArgs` instance that dictates the behaviour of the path
expansion.
heartbeat_cb: A function to be called regularly to send heartbeats.
Yields:
Absolute paths (as string objects) derived from input patterns.
Raises:
ValueError: For unsupported path types.
"""
if args.pathtype == rdf_paths.PathSpec.PathType.OS:
pathtype = rdf_paths.PathSpec.PathType.OS
else:
raise ValueError("Unsupported path type: ", args.pathtype)
opts = globbing.PathOpts(follow_links=args.follow_links,
xdev=args.xdev,
pathtype=pathtype)
for path in args.paths:
for expanded_path in globbing.ExpandPath(str(path), opts,
heartbeat_cb):
yield expanded_path
def GetExpandedPaths(args):
"""Expands given path patterns.
Args:
args: A `FileFinderArgs` instance that dictates the behaviour of the path
expansion.
Yields:
Absolute paths (as string objects) derived from input patterns.
Raises:
ValueError: For unsupported path types.
"""
if args.pathtype == rdf_paths.PathSpec.PathType.REGISTRY:
pathtype = rdf_paths.PathSpec.PathType.REGISTRY
elif args.pathtype == rdf_paths.PathSpec.PathType.OS:
pathtype = rdf_paths.PathSpec.PathType.OS
else:
raise ValueError("Unsupported path type: ", args.pathtype)
opts = globbing.PathOpts(follow_links=args.follow_links,
recursion_blacklist=_GetMountpointBlacklist(
args.xdev),
pathtype=pathtype)
for path in args.paths:
for expanded_path in globbing.ExpandPath(unicode(path), opts):
yield expanded_path
def _GetExpandedPaths(args):
"""Yields all possible expansions from given path patterns."""
opts = globbing.PathOpts(follow_links=args.follow_links,
pathtype=args.pathtype)
for path in args.paths:
for expanded_path in globbing.ExpandPath(str(path), opts):
yield expanded_path
def _GetExpandedPaths(
args: rdf_file_finder.FileFinderArgs,
heartbeat_cb: Callable[[], None] = _NoOp,
) -> Iterator[Text]:
"""Yields all possible expansions from given path patterns."""
opts = globbing.PathOpts(
follow_links=args.follow_links, pathtype=args.pathtype)
for path in args.paths:
for expanded_path in globbing.ExpandPath(str(path), opts, heartbeat_cb):
yield expanded_path
def _GetExpandedPaths(self, args):
"""Expands given path patterns.
Args:
args: A `FileFinderArgs` instance that dictates the behaviour of the path
expansion.
Yields:
Absolute paths (as string objects) derived from input patterns.
"""
opts = globbing.PathOpts(
follow_links=args.follow_links,
recursion_blacklist=_GetMountpointBlacklist(args.xdev))
for path in args.paths:
for expanded_path in globbing.ExpandPath(utils.SmartStr(path), opts):
yield expanded_path
def testFileArtifactParser(self):
"""Test parsing a fake file artifact with a file parser."""
processor = config_file.CronAtAllowDenyParser()
source = rdf_artifact.ArtifactSource(
type=rdf_artifact.ArtifactSource.SourceType.FILE,
attributes={
"paths": ["VFSFixture/etc/passwd", "numbers.txt"],
})
paths = []
for path in source.attributes["paths"]:
paths.append(os.path.join(self.base_path, path))
stat_cache = utils.StatCache()
expanded_paths = []
opts = globbing.PathOpts(follow_links=True)
for path in paths:
for expanded_path in globbing.ExpandPath(path, opts):
expanded_paths.append(expanded_path)
path_type = rdf_paths.PathSpec.PathType.OS
results = []
for path in expanded_paths:
stat = stat_cache.Get(path, follow_symlink=True)
pathspec = rdf_paths.PathSpec(
pathtype=path_type,
path=client_utils.LocalPathToCanonicalPath(stat.GetPath()),
path_options=rdf_paths.PathSpec.Options.CASE_LITERAL)
response = rdf_client_fs.FindSpec(pathspec=pathspec)
for res in artifact_collector.ParseSingleResponse(
processor, response, {}, path_type):
results.append(res)
self.assertEqual(len(results), 3)
self.assertTrue(
results[0]["filename"].endswith("test_data/VFSFixture/etc/passwd"))
self.assertIsInstance(results[0], rdf_protodict.AttributedDict)
self.assertEqual(len(results[0]["users"]), 3)
self.assertIsInstance(results[1], rdf_anomaly.Anomaly)
self.assertEqual(len(results[2]["users"]), 1000)
def testGlobbingExpandPathWorksWithTSK(self):
opts = globbing.PathOpts(pathtype=rdf_paths.PathSpec.PathType.TSK)
paths = globbing.ExpandPath("C:/Windows/System32/notepad.exe",
opts=opts)
self.assertEqual(list(paths), [u"C:\\Windows\\System32\\notepad.exe"])
