mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-14 08:56:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Clean and document Keyword class

Browse Source
This commit is contained in:
Richard Cordovano 2016-10-22 14:03:17 -04:00
parent c8fd478428
commit 181f65aee4
14 changed files with 166 additions and 114 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle.properties
View File

@ -186,7 +186,6 @@ Ingester.FscContentStream.getSrcInfo=File\:{0}
Ingester.FscContentStream.getReader=Not supported yet.
Ingester.NullContentStream.getSrcInfo.text=File\:{0}
Ingester.NullContentStream.getReader=Not supported yet.
Keyword.toString.text=Keyword'{'query\={0}, isLiteral\={1}, keywordType\={2}'}'
KeywordSearch.moduleErr=Module Error
KeywordSearch.fireNumIdxFileChg.moduleErr.msg=A module caused an error listening to KeywordSearch updates. See log to determine which module. Some data could be incomplete.
KeywordSearchListsEncase.save.exception.msg=Not supported yet.

1
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Bundle_ja.properties
View File

@ -207,7 +207,6 @@ KeywordSearchIngestModule.doInBackGround.pendingMsg=\uff08\u30da\u30f3\u30c7\u30
SearchRunner.doInBackGround.cancelMsg=\uff08\u30ad\u30e3\u30f3\u30bb\u30eb\u4e2d\u2026\uff09
Server.addDoc.exception.msg2=\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u30cf\u30f3\u30c9\u30e9\u30fc\u3092\u4f7f\u7528\u3057\u307e\u3057\u305f\u304c\u3001\u30a4\u30f3\u30c7\u30c3\u30af\u30b9\u306b\u6b21\u306e\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u3092\u8ffd\u52a0\u3067\u304d\u307e\u305b\u3093\u3067\u3057\u305f\uff1a{0}
ExtractedContentViewer.getSolrContent.txtBodyItal=<span style\=''font-style\:italic''>{0}</span>
Keyword.toString.text=Keyword'{'query\={0}, isLiteral\={1}, keywordType\={2}'}'
KeywordSearchJobSettingsPanel.keywordSearchEncodings.text=-
KeywordSearchJobSettingsPanel.languagesValLabel.text=-
KeywordSearchJobSettingsPanel.encodingsLabel.text=\u30a8\u30f3\u30b3\u30fc\u30c7\u30a3\u30f3\u30b0\uff1a

4
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/DropdownListSearchPanel.java
View File

@ -562,8 +562,8 @@ class DropdownListSearchPanel extends KeywordSearchPanel {
Boolean regex;
KeywordTableEntry(Keyword keyword) {
this.name = keyword.getQuery();
this.regex = !keyword.isLiteral();
this.name = keyword.getSearchTerm();
this.regex = !keyword.searchTermIsLiteral();
}
@Override

4
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/GlobalEditListPanel.java
View File

@ -581,10 +581,10 @@ class GlobalEditListPanel extends javax.swing.JPanel implements ListSelectionLis
Keyword word = currentKeywordList.getKeywords().get(rowIndex);
switch (columnIndex) {
case 0:
ret = (Object) word.getQuery();
ret = (Object) word.getSearchTerm();
break;
case 1:
ret = (Object) !word.isLiteral();
ret = (Object) !word.searchTermIsLiteral();
break;
default:
logger.log(Level.SEVERE, "Invalid table column index: {0}", columnIndex); //NON-NLS

144
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/Keyword.java
View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011-2014 Basis Technology Corp.
* Copyright 2011-2016 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -18,81 +18,135 @@
*/
package org.sleuthkit.autopsy.keywordsearch;
import org.openide.util.NbBundle;
import org.sleuthkit.datamodel.BlackboardAttribute;
/**
* Representation of single keyword to search for
* A representation of a keyword for which to search. The search term for the
* keyword may be either a literal term, with or without wildcards, or a regex.
*
* It is currently possible to optionally associate an artifact attribute type
* with a keyword. This feature was added to support an initial implementation
* of account number search and may be removed in the future.
*/
class Keyword {
private String keywordString; // keyword to search for
private boolean isLiteral; // false if reg exp
private boolean isWholeword; // false if match a substring
private BlackboardAttribute.ATTRIBUTE_TYPE keywordType = null;
private String term;
private boolean isLiteral;
private boolean isWholeword;
private BlackboardAttribute.ATTRIBUTE_TYPE artifactAtrributeType;
/**
* Constructs a representation of a keyword for which to search. The search
* term for the keyword may be either a literal term without wildcards or a
* regex.
*
* @param query Keyword to search for
* @param isLiteral false if reg exp
* @param term The search term for the keyword.
* @param isLiteral Whether or not the search term is a literal term instead
* of a regex. If the term is literal, this constructor
* assumes that it does not include wildcards.
*/
Keyword(String query, boolean isLiteral) {
this.keywordString = query;
Keyword(String term, boolean isLiteral) {
this.term = term;
this.isLiteral = isLiteral;
this.isWholeword = true;
}
/**
* Constructs a representation of a keyword for which to search. The search
* term may be either a literal term, with or without wildcards, or a regex.
*
* @param query Keyword to search for
* @param isLiteral false if reg exp
* @param isWholeword false to match substring (undefined behavior if regexp
* is true)
* @param term The search term.
* @param isLiteral Whether or not the search term is a literal term
* instead of a regex.
* @param hasNoWildcards Whether or not the search term, if it is a literal
* search term, includes wildcards.
*/
Keyword(String query, boolean isLiteral, boolean isWholeword) {
this.keywordString = query;
Keyword(String term, boolean isLiteral, boolean hasNoWildcards) {
this.term = term;
this.isLiteral = isLiteral;
this.isWholeword = isWholeword;
this.isWholeword = hasNoWildcards;
}
/**
* Constructs a representation of a keyword for which to search, for the
* purpose of finding a specific artifact attribute. The search term may be
* either a literal term, with or without wildcards, or a regex.
*
* @param query Keyword to search for
* @param isLiteral false if reg exp
* @param keywordType
* The association of an artifact attribute type with a keyword was added to
* support an initial implementation of account number search and may be
* removed in the future.
*
* @param term The search term.
* @param isLiteral Whether or not the search term is a literal term
* instead of a regex.
* @param hasNoWildcards Whether or not the search term, if it is a literal
* search term, includes wildcards.
* @param keywordType The artifact attribute type.
*/
Keyword(String query, boolean isLiteral, BlackboardAttribute.ATTRIBUTE_TYPE keywordType) {
this(query, isLiteral);
this.keywordType = keywordType;
}
void setType(BlackboardAttribute.ATTRIBUTE_TYPE keywordType) {
this.keywordType = keywordType;
}
BlackboardAttribute.ATTRIBUTE_TYPE getType() {
return this.keywordType;
Keyword(String term, boolean isLiteral, BlackboardAttribute.ATTRIBUTE_TYPE keywordType) {
this(term, isLiteral);
this.artifactAtrributeType = keywordType;
}
/**
* Gets the search term for the keyword, which may be either a literal term,
* with or without wild cards, or a regex.
*
* @return Keyword to search for
* @return The search term.
*/
String getQuery() {
return keywordString;
String getSearchTerm() {
return term;
}
boolean isLiteral() {
/**
* Indicates whether the search term for the keyword is a literal term, with
* or without wildcards, or a regex.
*
* @return True or false.
*/
boolean searchTermIsLiteral() {
return isLiteral;
}
boolean isWholeword() {
return isWholeword;
/**
* Indicates whether or not the search term for the keyword, if it is a
* literal term and not a regex, includes wildcards.
*
* @return True or false.
*/
boolean searchTermHasWildcards() {
return !isWholeword;
}
/**
* Sets the artifact attribute type associated with the keyword, if any.
*
* The association of an artifact attribute type with the keyword was added
* to support an initial implementation of account number search and may be
* removed in the future.
*
* @param artifactAtrributeType
*/
void setArtifactAttributeType(BlackboardAttribute.ATTRIBUTE_TYPE artifactAtrributeType) {
this.artifactAtrributeType = artifactAtrributeType;
}
/**
* Gets the artifact attribute type associated with the keyword, if any.
*
* The association of an artifact attribute type with the keyword was added
* to support an initial implementation of account number search and may be
* removed in the future.
*
* @return A attribute type object or null.
*/
BlackboardAttribute.ATTRIBUTE_TYPE getArtifactAttributeType() {
return this.artifactAtrributeType;
}
@Override
public String toString() {
return NbBundle.getMessage(this.getClass(), "Keyword.toString.text", keywordString, isLiteral, keywordType);
return String.format("Keyword{term='%s', isLiteral=%s, artifactAtrributeType=%s}", term, isLiteral, artifactAtrributeType);
}
@Override
@ -103,21 +157,19 @@ class Keyword {
if (getClass() != obj.getClass()) {
return false;
}
final Keyword other = (Keyword) obj;
if ((this.keywordString == null) ? (other.keywordString != null) : !this.keywordString.equals(other.keywordString)) {
Keyword other = (Keyword) obj;
if ((this.term == null) ? (other.term != null) : !this.term.equals(other.term)) {
return false;
}
if (this.isLiteral != other.isLiteral) {
return false;
}
return true;
return (this.isLiteral == other.isLiteral);
}
@Override
public int hashCode() {
int hash = 7;
hash = 17 * hash + (this.keywordString != null ? this.keywordString.hashCode() : 0);
hash = 17 * hash + (this.term != null ? this.term.hashCode() : 0);
hash = 17 * hash + (this.isLiteral ? 1 : 0);
return hash;
}
}

27
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordList.java
View File

@ -1,15 +1,15 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011-2014 Basis Technology Corp.
*
* Copyright 2011-2016 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
*
* http://www.apache.org/licenses/LICENSE-2.0
*
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@ -21,22 +21,27 @@ package org.sleuthkit.autopsy.keywordsearch;
import java.util.Date;
import java.util.List;
/**
* A list of keywords for which to search. Includes list creation and
* modification metadata and a setting that indicates whether messages should be
* sent to the ingest messages inbox when a keyword in the list is found.
*/
public class KeywordList {
private String name;
private Date created;
private Date modified;
private Boolean useForIngest;
private Boolean ingestMessages;
private Boolean postIngestMessages;
private List<Keyword> keywords;
private Boolean locked;
KeywordList(String name, Date created, Date modified, Boolean useForIngest, Boolean ingestMessages, List<Keyword> keywords, boolean locked) {
KeywordList(String name, Date created, Date modified, Boolean useForIngest, Boolean postIngestMessages, List<Keyword> keywords, boolean locked) {
this.name = name;
this.created = created;
this.modified = modified;
this.useForIngest = useForIngest;
this.ingestMessages = ingestMessages;
this.postIngestMessages = postIngestMessages;
this.keywords = keywords;
this.locked = locked;
}
@ -96,11 +101,11 @@ public class KeywordList {
}
Boolean getIngestMessages() {
return ingestMessages;
return postIngestMessages;
}
void setIngestMessages(boolean ingestMessages) {
this.ingestMessages = ingestMessages;
this.postIngestMessages = ingestMessages;
}
List<Keyword> getKeywords() {
@ -114,7 +119,7 @@ public class KeywordList {
boolean hasKeyword(String keyword) {
//note, this ignores isLiteral
for (Keyword k : keywords) {
if (k.getQuery().equals(keyword)) {
if (k.getSearchTerm().equals(keyword)) {
return true;
}
}

29
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchQuery.java
View File

@ -1,7 +1,7 @@
/*
* Autopsy Forensic Browser
*
* Copyright 2011 Basis Technology Corp.
* Copyright 2011-2016 Basis Technology Corp.
* Contact: carrier <at> sleuthkit <dot> org
*
* Licensed under the Apache License, Version 2.0 (the "License");
@ -18,11 +18,8 @@
*/
package org.sleuthkit.autopsy.keywordsearch;
import org.sleuthkit.datamodel.AbstractFile;
/**
* Interface for a search query. Implemented by various engines or methods of
* using the same engine. One of these is created for each query.
* Interface for kewyord search queries.
*/
interface KeywordSearchQuery {
@ -33,7 +30,7 @@ interface KeywordSearchQuery {
*
* @return true if the query passed validation
*/
public boolean validate();
boolean validate();
/**
* execute query and return results without publishing them return results
@ -43,7 +40,7 @@ interface KeywordSearchQuery {
* could be a notification to stop processing
* @return
*/
public QueryResults performQuery() throws NoOpenCoreException;
QueryResults performQuery() throws NoOpenCoreException;
/**
* Set an optional filter to narrow down the search Adding multiple filters
@ -51,14 +48,14 @@ interface KeywordSearchQuery {
*
* @param filter filter to set on the query
*/
public void addFilter(KeywordQueryFilter filter);
void addFilter(KeywordQueryFilter filter);
/**
* Set an optional SOLR field to narrow down the search
*
* @param field field to set on the query
*/
public void setField(String field);
void setField(String field);
/**
* Modify the query string to be searched as a substring instead of a whole
@ -66,39 +63,39 @@ interface KeywordSearchQuery {
*
* @param isSubstring
*/
public void setSubstringQuery();
void setSubstringQuery();
/**
* escape the query string and use the escaped string in the query
*/
public void escape();
void escape();
/**
*
* @return true if query was escaped
*/
public boolean isEscaped();
boolean isEscaped();
/**
*
* @return true if query is a literal query (non regex)
*/
public boolean isLiteral();
boolean isLiteral();
/**
* return original keyword/query string
*
* @return the query String supplied originally
*/
public String getQueryString();
String getQueryString();
/**
* return escaped keyword/query string if escaping was done
*
* @return the escaped query string, or original string if no escaping done
*/
public String getEscapedQueryString();
String getEscapedQueryString();
public KeywordCachedArtifact writeSingleFileHitsToBlackBoard(String termHit, KeywordHit hit, String snippet, String listName);
KeywordCachedArtifact writeSingleFileHitsToBlackBoard(String termHit, KeywordHit hit, String snippet, String listName);
}

4
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchQueryDelegator.java
View File

@ -55,9 +55,9 @@ class KeywordSearchQueryDelegator {
for (KeywordList keywordList : keywordLists) {
for (Keyword keyword : keywordList.getKeywords()) {
KeywordSearchQuery query;
if (keyword.isLiteral()) {
if (keyword.searchTermIsLiteral()) {
// literal, exact match
if (keyword.isWholeword()) {
if (keyword.searchTermHasWildcards()) {
query = new LuceneQuery(keywordList, keyword);
query.escape();
} // literal, substring match

6
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchResultFactory.java
View File

@ -255,8 +255,8 @@ class KeywordSearchResultFactory extends ChildFactory<KeyValueQueryContent> {
//the query is executed later on demand
if (queryResults.getKeywords().size() == 1) {
//simple case, no need to process subqueries and do special escaping
Keyword term = queryResults.getKeywords().iterator().next();
return constructEscapedSolrQuery(term.getQuery(), literal_query);
Keyword keyword = queryResults.getKeywords().iterator().next();
return constructEscapedSolrQuery(keyword.getSearchTerm(), literal_query);
} else {
//find terms for this content hit
List<Keyword> hitTerms = new ArrayList<>();
@ -274,7 +274,7 @@ class KeywordSearchResultFactory extends ChildFactory<KeyValueQueryContent> {
int curTerm = 0;
for (Keyword term : hitTerms) {
//escape subqueries, MAKE SURE they are not escaped again later
highlightQuery.append(constructEscapedSolrQuery(term.getQuery(), literal_query));
highlightQuery.append(constructEscapedSolrQuery(term.getSearchTerm(), literal_query));
if (lastTerm != curTerm) {
highlightQuery.append(" "); //acts as OR ||
}

14
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/LuceneQuery.java
View File

@ -55,7 +55,7 @@ class LuceneQuery implements KeywordSearchQuery {
private final String keywordString; //original unescaped query
private String keywordStringEscaped;
private boolean isEscaped;
private Keyword keywordQuery = null;
private Keyword keyword = null;
private KeywordList keywordList = null;
private final List<KeywordQueryFilter> filters = new ArrayList<>();
private String field = null;
@ -72,15 +72,15 @@ class LuceneQuery implements KeywordSearchQuery {
/**
* Constructor with query to process.
*
* @param keywordQuery
* @param keyword
*/
public LuceneQuery(KeywordList keywordList, Keyword keywordQuery) {
public LuceneQuery(KeywordList keywordList, Keyword keyword) {
this.keywordList = keywordList;
this.keywordQuery = keywordQuery;
this.keyword = keyword;
// @@@ BC: Long-term, we should try to get rid of this string and use only the
// keyword object. Refactoring did not make its way through this yet.
this.keywordString = keywordQuery.getQuery();
this.keywordString = keyword.getSearchTerm();
this.keywordStringEscaped = this.keywordString;
}
@ -168,8 +168,8 @@ class LuceneQuery implements KeywordSearchQuery {
//bogus - workaround the dir tree table issue
//attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_KEYWORD_REGEXP.getTypeID(), MODULE_NAME, "", ""));
//selector
if (keywordQuery != null) {
BlackboardAttribute.ATTRIBUTE_TYPE selType = keywordQuery.getType();
if (keyword != null) {
BlackboardAttribute.ATTRIBUTE_TYPE selType = keyword.getArtifactAttributeType();
if (selType != null) {
attributes.add(new BlackboardAttribute(selType, MODULE_NAME, termHit));
}

6
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/QueryResults.java
View File

@ -115,7 +115,7 @@ class QueryResults {
for (final Keyword keyword : getKeywords()) {
if (worker.isCancelled()) {
logger.log(Level.INFO, "Cancel detected, bailing before new keyword processed: {0}", keyword.getQuery()); //NON-NLS
logger.log(Level.INFO, "Cancel detected, bailing before new keyword processed: {0}", keyword.getSearchTerm()); //NON-NLS
break;
}
@ -124,7 +124,7 @@ class QueryResults {
progress.progress(keyword.toString(), unitProgress);
}
if (subProgress != null) {
String hitDisplayStr = keyword.getQuery();
String hitDisplayStr = keyword.getSearchTerm();
if (hitDisplayStr.length() > 50) {
hitDisplayStr = hitDisplayStr.substring(0, 49) + "...";
}
@ -132,7 +132,7 @@ class QueryResults {
}
for (KeywordHit hit : getOneHitPerObject(keyword)) {
String termString = keyword.getQuery();
String termString = keyword.getSearchTerm();
final String snippetQuery = KeywordSearchUtil.escapeLuceneQuery(termString);
String snippet;
try {

18
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/SearchRunner.java
View File

@ -403,7 +403,7 @@ public final class SearchRunner {
ProgressContributor[] subProgresses = new ProgressContributor[keywords.size()];
int i = 0;
for (Keyword keywordQuery : keywords) {
subProgresses[i] = AggregateProgressFactory.createProgressContributor(keywordQuery.getQuery());
subProgresses[i] = AggregateProgressFactory.createProgressContributor(keywordQuery.getSearchTerm());
progressGroup.addContributor(subProgresses[i]);
i++;
}
@ -419,11 +419,11 @@ public final class SearchRunner {
for (Keyword keywordQuery : keywords) {
if (this.isCancelled()) {
logger.log(Level.INFO, "Cancel detected, bailing before new keyword processed: {0}", keywordQuery.getQuery()); //NON-NLS
logger.log(Level.INFO, "Cancel detected, bailing before new keyword processed: {0}", keywordQuery.getSearchTerm()); //NON-NLS
return null;
}
final String queryStr = keywordQuery.getQuery();
final String queryStr = keywordQuery.getSearchTerm();
final KeywordList list = keywordToList.get(queryStr);
//new subProgress will be active after the initial query
@ -434,7 +434,7 @@ public final class SearchRunner {
KeywordSearchQuery keywordSearchQuery = null;
boolean isRegex = !keywordQuery.isLiteral();
boolean isRegex = !keywordQuery.searchTermIsLiteral();
if (isRegex) {
keywordSearchQuery = new TermsComponentQuery(list, keywordQuery);
} else {
@ -454,16 +454,16 @@ public final class SearchRunner {
try {
queryResults = keywordSearchQuery.performQuery();
} catch (NoOpenCoreException ex) {
logger.log(Level.WARNING, "Error performing query: " + keywordQuery.getQuery(), ex); //NON-NLS
logger.log(Level.WARNING, "Error performing query: " + keywordQuery.getSearchTerm(), ex); //NON-NLS
//no reason to continue with next query if recovery failed
//or wait for recovery to kick in and run again later
//likely case has closed and threads are being interrupted
return null;
} catch (CancellationException e) {
logger.log(Level.INFO, "Cancel detected, bailing during keyword query: {0}", keywordQuery.getQuery()); //NON-NLS
logger.log(Level.INFO, "Cancel detected, bailing during keyword query: {0}", keywordQuery.getSearchTerm()); //NON-NLS
return null;
} catch (Exception e) {
logger.log(Level.WARNING, "Error performing query: " + keywordQuery.getQuery(), e); //NON-NLS
logger.log(Level.WARNING, "Error performing query: " + keywordQuery.getSearchTerm(), e); //NON-NLS
continue;
}
@ -481,7 +481,7 @@ public final class SearchRunner {
int totalUnits = newResults.getKeywords().size();
subProgresses[keywordsSearched].start(totalUnits);
int unitProgress = 0;
String queryDisplayStr = keywordQuery.getQuery();
String queryDisplayStr = keywordQuery.getSearchTerm();
if (queryDisplayStr.length() > 50) {
queryDisplayStr = queryDisplayStr.substring(0, 49) + "...";
}
@ -547,7 +547,7 @@ public final class SearchRunner {
keywordLists.add(list);
for (Keyword k : list.getKeywords()) {
keywords.add(k);
keywordToList.put(k.getQuery(), list);
keywordToList.put(k.getSearchTerm(), list);
}
}
}

14
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/TermsComponentQuery.java
View File

@ -121,7 +121,7 @@ final class TermsComponentQuery implements KeywordSearchQuery {
this.keyword = keyword;
this.keywordList = keywordList;
this.escapedQuery = keyword.getQuery();
this.escapedQuery = keyword.getSearchTerm();
}
@Override
@ -146,7 +146,7 @@ final class TermsComponentQuery implements KeywordSearchQuery {
@Override
public void escape() {
escapedQuery = Pattern.quote(keyword.getQuery());
escapedQuery = Pattern.quote(keyword.getSearchTerm());
isEscaped = true;
}
@ -181,7 +181,7 @@ final class TermsComponentQuery implements KeywordSearchQuery {
@Override
public String getQueryString() {
return keyword.getQuery();
return keyword.getSearchTerm();
}
@Override
@ -189,7 +189,7 @@ final class TermsComponentQuery implements KeywordSearchQuery {
BlackboardArtifact newArtifact;
Collection<BlackboardAttribute> attributes = new ArrayList<>();
if (keyword.getType() == ATTRIBUTE_TYPE.TSK_CARD_NUMBER) {
if (keyword.getArtifactAttributeType() == ATTRIBUTE_TYPE.TSK_CARD_NUMBER) {
attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_ACCOUNT_TYPE, MODULE_NAME, Account.Type.CREDIT_CARD.name()));
Map<BlackboardAttribute.Type, BlackboardAttribute> parsedTrackAttributeMap = new HashMap<>();
@ -266,7 +266,7 @@ final class TermsComponentQuery implements KeywordSearchQuery {
//regex match
attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_KEYWORD, MODULE_NAME, termHit));
//regex keyword
attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_KEYWORD_REGEXP, MODULE_NAME, keyword.getQuery()));
attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_KEYWORD_REGEXP, MODULE_NAME, keyword.getSearchTerm()));
//make keyword hit artifact
try {
@ -325,7 +325,7 @@ final class TermsComponentQuery implements KeywordSearchQuery {
try {
terms = KeywordSearch.getServer().queryTerms(q).getTerms(TERMS_SEARCH_FIELD);
} catch (KeywordSearchModuleException ex) {
LOGGER.log(Level.SEVERE, "Error executing the regex terms query: " + keyword.getQuery(), ex); //NON-NLS
LOGGER.log(Level.SEVERE, "Error executing the regex terms query: " + keyword.getSearchTerm(), ex); //NON-NLS
//TODO: this is almost certainly wrong and guaranteed to throw a NPE at some point!!!!
}
@ -339,7 +339,7 @@ final class TermsComponentQuery implements KeywordSearchQuery {
for (Term term : terms) {
final String termStr = KeywordSearchUtil.escapeLuceneQuery(term.getTerm());
if (keyword.getType() == ATTRIBUTE_TYPE.TSK_CARD_NUMBER) {
if (keyword.getArtifactAttributeType() == ATTRIBUTE_TYPE.TSK_CARD_NUMBER) {
//If the keyword is a credit card number, pass it through luhn validator
Matcher matcher = CCN_PATTERN.matcher(term.getTerm());
matcher.find();

8
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/XmlKeywordSearchList.java
View File

@ -123,13 +123,13 @@ final class XmlKeywordSearchList extends KeywordSearchList {
for (Keyword keyword : keywords) {
Element keywordEl = doc.createElement(KEYWORD_EL);
String literal = keyword.isLiteral() ? "true" : "false"; //NON-NLS
String literal = keyword.searchTermIsLiteral() ? "true" : "false"; //NON-NLS
keywordEl.setAttribute(KEYWORD_LITERAL_ATTR, literal);
BlackboardAttribute.ATTRIBUTE_TYPE selectorType = keyword.getType();
BlackboardAttribute.ATTRIBUTE_TYPE selectorType = keyword.getArtifactAttributeType();
if (selectorType != null) {
keywordEl.setAttribute(KEYWORD_SELECTOR_ATTR, selectorType.getLabel());
}
keywordEl.setTextContent(keyword.getQuery());
keywordEl.setTextContent(keyword.getSearchTerm());
listEl.appendChild(keywordEl);
}
rootEl.appendChild(listEl);
@ -199,7 +199,7 @@ final class XmlKeywordSearchList extends KeywordSearchList {
String selector = wordEl.getAttribute(KEYWORD_SELECTOR_ATTR);
if (!selector.equals("")) {
BlackboardAttribute.ATTRIBUTE_TYPE selectorType = BlackboardAttribute.ATTRIBUTE_TYPE.fromLabel(selector);
keyword.setType(selectorType);
keyword.setArtifactAttributeType(selectorType);
}
words.add(keyword);