def testParseFilter(self):
queries = [
('bla is "red"', True),
('bla.bla is "red"', True),
('bla."bla bliek" is "red"', True),
('bla.bla bliek is "red"', False),
]
for query, result in queries:
if result:
plist_lib.PlistFilterParser(query).Parse()
else:
filter_parser = plist_lib.PlistFilterParser(query)
self.assertRaises(Exception, filter_parser.Parse)
def Run(self, args):
self.context = args.context
self.filter_query = args.query
with vfs.VFSOpen(args.pathspec, progress_callback=self.Progress) as fd:
data = fd.Read(self.MAX_PLIST_SIZE)
plist = binplist.readPlist(cStringIO.StringIO(data))
# Create the query parser
parser = plist_lib.PlistFilterParser(self.filter_query).Parse()
filter_imp = plist_lib.PlistFilterImplementation
matcher = parser.Compile(filter_imp)
if self.context:
# Obtain the values for the context using the value expander
value_expander = filter_imp.FILTERS["ValueExpander"]
iterator = value_expander().Expand(plist, self.context)
else:
# If we didn't get a context, the context is the whole plist
iterator = [plist]
reply = rdfvalue.RDFValueArray()
for item in iterator:
# As we're setting the context manually, we need to account for types
if isinstance(item, types.ListType):
for sub_item in item:
partial_plist = plist_lib.PlistValueToPlainValue(
sub_item)
if matcher.Matches(partial_plist):
reply.Append(sub_item)
else:
partial_plist = plist_lib.PlistValueToPlainValue(item)
if matcher.Matches(partial_plist):
reply.Append(partial_plist)
self.SendReply(reply)
def testMatches(self):
query = '"nested1"."nested11"."key112" contains "value112"'
parser = plist_lib.PlistFilterParser(query).Parse()
matcher = parser.Compile(plist_lib.PlistFilterImplementation)
self.assertEqual(matcher.Matches(test_plist_dict), True)
