diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchQuery.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchQuery.java index da269e2d2c..4f71b18f5c 100755 --- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchQuery.java +++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/KeywordSearchQuery.java @@ -101,20 +101,20 @@ interface KeywordSearchQuery { String getEscapedQueryString(); /** - * Converts the keyword hits for a given search term into artifacts. + * Posts a keyword hit artifact to the blackboard for a given keyword hit. * - * @param content The Content object associated with the hit. + * @param content The text source object for the hit. * @param foundKeyword The keyword that was found by the search, this may be * different than the Keyword that was searched if, for * example, it was a RegexQuery. * @param hit The keyword hit. - * @param snippet The document snippet that contains the hit. + * @param snippet A snippet from the text that contains the hit. * @param listName The name of the keyword list that contained the * keyword for which the hit was found. * * - * @return The newly created artifact or Null if there was a problem + * @return The newly created artifact or null if there was a problem * creating it. */ - BlackboardArtifact writeSingleFileHitsToBlackBoard(Content content, Keyword foundKeyword, KeywordHit hit, String snippet, String listName); + BlackboardArtifact postKeywordHitToBlackboard(Content content, Keyword foundKeyword, KeywordHit hit, String snippet, String listName); } diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/LuceneQuery.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/LuceneQuery.java index 4d3f9cc5b9..e13531da26 100755 --- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/LuceneQuery.java +++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/LuceneQuery.java @@ -52,8 +52,8 @@ class LuceneQuery implements KeywordSearchQuery { private static final Logger logger = Logger.getLogger(LuceneQuery.class.getName()); private String keywordStringEscaped; private boolean isEscaped; - private final Keyword originalKeyword ; - private final KeywordList keywordList ; + private final Keyword originalKeyword; + private final KeywordList keywordList; private final List filters = new ArrayList<>(); private String field = null; private static final int MAX_RESULTS_PER_CURSOR_MARK = 512; @@ -70,7 +70,7 @@ class LuceneQuery implements KeywordSearchQuery { LuceneQuery(KeywordList keywordList, Keyword keyword) { this.keywordList = keywordList; this.originalKeyword = keyword; - this.keywordStringEscaped = this.originalKeyword.getSearchTerm(); + this.keywordStringEscaped = this.originalKeyword.getSearchTerm(); } @Override @@ -191,8 +191,24 @@ class LuceneQuery implements KeywordSearchQuery { return StringUtils.isNotBlank(originalKeyword.getSearchTerm()); } + /** + * Posts a keyword hit artifact to the blackboard for a given keyword hit. + * + * @param content The text source object for the hit. + * @param foundKeyword The keyword that was found by the search, this may be + * different than the Keyword that was searched if, for + * example, it was a RegexQuery. + * @param hit The keyword hit. + * @param snippet A snippet from the text that contains the hit. + * @param listName The name of the keyword list that contained the + * keyword for which the hit was found. + * + * + * @return The newly created artifact or null if there was a problem + * creating it. + */ @Override - public BlackboardArtifact writeSingleFileHitsToBlackBoard(Content content, Keyword foundKeyword, KeywordHit hit, String snippet, String listName) { + public BlackboardArtifact postKeywordHitToBlackboard(Content content, Keyword foundKeyword, KeywordHit hit, String snippet, String listName) { final String MODULE_NAME = KeywordSearchModuleFactory.getModuleName(); Collection attributes = new ArrayList<>(); @@ -225,11 +241,9 @@ class LuceneQuery implements KeywordSearchQuery { } } - hit.getArtifactID().ifPresent(artifactID -> attributes.add(new BlackboardAttribute(BlackboardAttribute.ATTRIBUTE_TYPE.TSK_ASSOCIATED_ARTIFACT, MODULE_NAME, artifactID)) ); - try { bba.addAttributes(attributes); //write out to bb @@ -398,10 +412,10 @@ class LuceneQuery implements KeywordSearchQuery { return EscapeUtil.unEscapeHtml(contentHighlights.get(0)).trim(); } } catch (NoOpenCoreException ex) { - logger.log(Level.SEVERE, "Error executing Lucene Solr Query: " + query +". Solr doc id " + solrObjectId + ", chunkID " + chunkID , ex); //NON-NLS + logger.log(Level.SEVERE, "Error executing Lucene Solr Query: " + query + ". Solr doc id " + solrObjectId + ", chunkID " + chunkID, ex); //NON-NLS throw ex; } catch (KeywordSearchModuleException ex) { - logger.log(Level.SEVERE, "Error executing Lucene Solr Query: " + query +". Solr doc id " + solrObjectId + ", chunkID " + chunkID , ex); //NON-NLS + logger.log(Level.SEVERE, "Error executing Lucene Solr Query: " + query + ". Solr doc id " + solrObjectId + ", chunkID " + chunkID, ex); //NON-NLS return ""; } } diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/QueryResults.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/QueryResults.java index 516b96eaab..7037f898be 100755 --- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/QueryResults.java +++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/QueryResults.java @@ -63,6 +63,8 @@ class QueryResults { * blackboard, sending messages about the search hits to the ingest inbox, * and publishing an event to notify subscribers of the blackboard posts. * + * The KeywordSearchQuery is used to do the blackboard posts. + * * @param query The query. */ QueryResults(KeywordSearchQuery query) { @@ -219,7 +221,7 @@ class QueryResults { /* * Post an artifact for the hit to the blackboard. */ - BlackboardArtifact artifact = query.writeSingleFileHitsToBlackBoard(content, keyword, hit, snippet, query.getKeywordList().getName()); + BlackboardArtifact artifact = query.postKeywordHitToBlackboard(content, keyword, hit, snippet, query.getKeywordList().getName()); if (null == artifact) { logger.log(Level.SEVERE, "Error posting keyword hit artifact for keyword {0} in {1} to the blackboard", new Object[]{keyword.toString(), content}); //NON-NLS } diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/RegexQuery.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/RegexQuery.java index 392a5e8bc8..0927b68d6c 100755 --- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/RegexQuery.java +++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/RegexQuery.java @@ -401,8 +401,24 @@ final class RegexQuery implements KeywordSearchQuery { return escapedQuery; } + /** + * Posts a keyword hit artifact to the blackboard for a given keyword hit. + * + * @param content The text source object for the hit. + * @param foundKeyword The keyword that was found by the search, this may be + * different than the Keyword that was searched if, for + * example, it was a RegexQuery. + * @param hit The keyword hit. + * @param snippet A snippet from the text that contains the hit. + * @param listName The name of the keyword list that contained the + * keyword for which the hit was found. + * + * + * @return The newly created artifact or null if there was a problem + * creating it. + */ @Override - public BlackboardArtifact writeSingleFileHitsToBlackBoard(Content content, Keyword foundKeyword, KeywordHit hit, String snippet, String listName) { + public BlackboardArtifact postKeywordHitToBlackboard(Content content, Keyword foundKeyword, KeywordHit hit, String snippet, String listName) { final String MODULE_NAME = KeywordSearchModuleFactory.getModuleName(); if (content == null) { diff --git a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/TermsComponentQuery.java b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/TermsComponentQuery.java index 58087c4590..ab647ec048 100755 --- a/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/TermsComponentQuery.java +++ b/KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/TermsComponentQuery.java @@ -79,8 +79,8 @@ final class TermsComponentQuery implements KeywordSearchQuery { * digit is 2 through 6 * */ - static final Pattern CREDIT_CARD_NUM_PATTERN = - Pattern.compile("(?[2-6]([ -]?[0-9]){11,18})"); + static final Pattern CREDIT_CARD_NUM_PATTERN + = Pattern.compile("(?[2-6]([ -]?[0-9]){11,18})"); static final Pattern CREDIT_CARD_TRACK1_PATTERN = Pattern.compile( /* * Track 1 is alphanumeric. @@ -124,7 +124,6 @@ final class TermsComponentQuery implements KeywordSearchQuery { + "?)?)?)?)?)?"); //close nested optional groups //NON-NLS static final BlackboardAttribute.Type KEYWORD_SEARCH_DOCUMENT_ID = new BlackboardAttribute.Type(ATTRIBUTE_TYPE.TSK_KEYWORD_SEARCH_DOCUMENT_ID); - /** * Constructs an object that implements a regex query that will be performed * as a two step operation. In the first step, the Solr terms component is @@ -325,8 +324,24 @@ final class TermsComponentQuery implements KeywordSearchQuery { return results; } + /** + * Posts a keyword hit artifact to the blackboard for a given keyword hit. + * + * @param content The text source object for the hit. + * @param foundKeyword The keyword that was found by the search, this may be + * different than the Keyword that was searched if, for + * example, it was a RegexQuery. + * @param hit The keyword hit. + * @param snippet A snippet from the text that contains the hit. + * @param listName The name of the keyword list that contained the + * keyword for which the hit was found. + * + * + * @return The newly created artifact or null if there was a problem + * creating it. + */ @Override - public BlackboardArtifact writeSingleFileHitsToBlackBoard(Content content, Keyword foundKeyword, KeywordHit hit, String snippet, String listName) { + public BlackboardArtifact postKeywordHitToBlackboard(Content content, Keyword foundKeyword, KeywordHit hit, String snippet, String listName) { /* * Create either a "plain vanilla" keyword hit artifact with keyword and * regex attributes, or a credit card account artifact with attributes