mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-15 09:17:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

SearchRunner and KeywordSearchPanel now use same logic to select proper KeywordSearchQuery for Keyword

Browse Source
This commit is contained in:
Eugene Livis 2017-03-16 13:41:23 -04:00
parent 09cc46e736
commit 19212bcdf1
3 changed files with 32 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchQueryDelegator.java
View File

@ -55,22 +55,7 @@ class KeywordSearchQueryDelegator {
for (KeywordList keywordList : keywordLists) { for (KeywordList keywordList : keywordLists) {
for (Keyword keyword : keywordList.getKeywords()) { for (Keyword keyword : keywordList.getKeywords()) {
KeywordSearchQuery query; KeywordSearchQuery query = KeywordSearchUtil.getQueryForKeyword(keyword, keywordList);
if (keyword.searchTermIsLiteral()) {
// literal, exact match
if (keyword.searchTermIsWholeWord()) {
query = new LuceneQuery(keywordList, keyword);
query.escape();
} // literal, substring match
else {
query = new TermsComponentQuery(keywordList, keyword);
query.escape();
query.setSubstringQuery();
}
} // regexp
else {
query = new RegexQuery(keywordList, keyword);
}
queryDelegates.add(query); queryDelegates.add(query);
} }
} }

20
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchUtil.java
View File

@ -126,6 +126,26 @@ class KeywordSearchUtil {
return false; return false;
} }
} }
static KeywordSearchQuery getQueryForKeyword(Keyword keyword, KeywordList keywordList) {
KeywordSearchQuery query = null;
if (keyword.searchTermIsLiteral()) {
// literal, exact match
if (keyword.searchTermIsWholeWord()) {
query = new LuceneQuery(keywordList, keyword);
query.escape();
} // literal, substring match
else {
query = new TermsComponentQuery(keywordList, keyword);
query.escape();
query.setSubstringQuery();
}
} // regexp
else {
query = new RegexQuery(keywordList, keyword);
}
return query;
}
/** /**
* Is the Keyword Search list at absPath an XML list? * Is the Keyword Search list at absPath an XML list?

30
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/SearchRunner.java
View File

@ -425,14 +425,14 @@ public final class SearchRunner {
int keywordsSearched = 0; int keywordsSearched = 0;
for (Keyword keywordQuery : keywords) { for (Keyword keyword : keywords) {
if (this.isCancelled()) { if (this.isCancelled()) {
logger.log(Level.INFO, "Cancel detected, bailing before new keyword processed: {0}", keywordQuery.getSearchTerm()); //NON-NLS logger.log(Level.INFO, "Cancel detected, bailing before new keyword processed: {0}", keyword.getSearchTerm()); //NON-NLS
return null; return null;
} }
final String queryStr = keywordQuery.getSearchTerm(); final String queryStr = keyword.getSearchTerm();
final KeywordList list = keywordToList.get(queryStr); final KeywordList keywordList = keywordToList.get(queryStr);
//new subProgress will be active after the initial query //new subProgress will be active after the initial query
//when we know number of hits to start() with //when we know number of hits to start() with
@ -440,15 +440,7 @@ public final class SearchRunner {
subProgresses[keywordsSearched - 1].finish(); subProgresses[keywordsSearched - 1].finish();
} }
KeywordSearchQuery keywordSearchQuery = null; KeywordSearchQuery keywordSearchQuery = KeywordSearchUtil.getQueryForKeyword(keyword, keywordList);
boolean isRegex = !keywordQuery.searchTermIsLiteral();
if (isRegex) {
keywordSearchQuery = new RegexQuery(list, keywordQuery);
} else {
keywordSearchQuery = new LuceneQuery(list, keywordQuery);
keywordSearchQuery.escape();
}
// Filtering // Filtering
//limit search to currently ingested data sources //limit search to currently ingested data sources
@ -462,14 +454,14 @@ public final class SearchRunner {
try { try {
queryResults = keywordSearchQuery.performQuery(); queryResults = keywordSearchQuery.performQuery();
} catch (KeywordSearchModuleException | NoOpenCoreException ex) { } catch (KeywordSearchModuleException | NoOpenCoreException ex) {
logger.log(Level.SEVERE, "Error performing query: " + keywordQuery.getSearchTerm(), ex); //NON-NLS logger.log(Level.SEVERE, "Error performing query: " + keyword.getSearchTerm(), ex); //NON-NLS
MessageNotifyUtil.Notify.error(Bundle.SearchRunner_query_exception_msg() + keywordQuery.getSearchTerm(), ex.getCause().getMessage()); MessageNotifyUtil.Notify.error(Bundle.SearchRunner_query_exception_msg() + keyword.getSearchTerm(), ex.getCause().getMessage());
//no reason to continue with next query if recovery failed //no reason to continue with next query if recovery failed
//or wait for recovery to kick in and run again later //or wait for recovery to kick in and run again later
//likely case has closed and threads are being interrupted //likely case has closed and threads are being interrupted
return null; return null;
} catch (CancellationException e) { } catch (CancellationException e) {
logger.log(Level.INFO, "Cancel detected, bailing during keyword query: {0}", keywordQuery.getSearchTerm()); //NON-NLS logger.log(Level.INFO, "Cancel detected, bailing during keyword query: {0}", keyword.getSearchTerm()); //NON-NLS
return null; return null;
} }
@ -487,14 +479,14 @@ public final class SearchRunner {
int totalUnits = newResults.getKeywords().size(); int totalUnits = newResults.getKeywords().size();
subProgresses[keywordsSearched].start(totalUnits); subProgresses[keywordsSearched].start(totalUnits);
int unitProgress = 0; int unitProgress = 0;
String queryDisplayStr = keywordQuery.getSearchTerm(); String queryDisplayStr = keyword.getSearchTerm();
if (queryDisplayStr.length() > 50) { if (queryDisplayStr.length() > 50) {
queryDisplayStr = queryDisplayStr.substring(0, 49) + "..."; queryDisplayStr = queryDisplayStr.substring(0, 49) + "...";
} }
subProgresses[keywordsSearched].progress(list.getName() + ": " + queryDisplayStr, unitProgress); subProgresses[keywordsSearched].progress(keywordList.getName() + ": " + queryDisplayStr, unitProgress);
// Create blackboard artifacts // Create blackboard artifacts
newArtifacts = newResults.writeAllHitsToBlackBoard(null, subProgresses[keywordsSearched], this, list.getIngestMessages()); newArtifacts = newResults.writeAllHitsToBlackBoard(null, subProgresses[keywordsSearched], this, keywordList.getIngestMessages());
} //if has results } //if has results