mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-19 11:07:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

2094 clean up of InterestingItemsFilesSetSettings.java

Browse Source
This commit is contained in:
William Schaefer 2017-02-23 18:15:15 -05:00
parent eef98e507f
commit 7014c9a509
1 changed files with 39 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

75
Core/src/org/sleuthkit/autopsy/modules/interestingitems/InterestingItemsFilesSetSettings.java
View File

@ -59,7 +59,6 @@ class InterestingItemsFilesSetSettings implements Serializable {
// TSK Framework FilesSet definitions file schema. // TSK Framework FilesSet definitions file schema.
private static final String FILE_SETS_ROOT_TAG = "INTERESTING_FILE_SETS"; //NON-NLS private static final String FILE_SETS_ROOT_TAG = "INTERESTING_FILE_SETS"; //NON-NLS
private static final String DESC_ATTR = "description"; //NON-NLS private static final String DESC_ATTR = "description"; //NON-NLS
private static final String RULE_UUID_ATTR = "ruleUUID"; //NON-NLS
private static final String IGNORE_KNOWN_FILES_ATTR = "ignoreKnown"; //NON-NLS private static final String IGNORE_KNOWN_FILES_ATTR = "ignoreKnown"; //NON-NLS
private static final String PATH_REGEX_ATTR = "pathRegex"; //NON-NLS private static final String PATH_REGEX_ATTR = "pathRegex"; //NON-NLS
private static final String TYPE_FILTER_VALUE_ALL = "all"; private static final String TYPE_FILTER_VALUE_ALL = "all";
@ -71,7 +70,6 @@ class InterestingItemsFilesSetSettings implements Serializable {
private static final List<String> illegalFileNameChars = FilesSetsManager.getIllegalFileNameChars(); private static final List<String> illegalFileNameChars = FilesSetsManager.getIllegalFileNameChars();
private static final String FILE_SET_TAG = "INTERESTING_FILE_SET"; //NON-NLS private static final String FILE_SET_TAG = "INTERESTING_FILE_SET"; //NON-NLS
private static final String NAME_RULE_TAG = "NAME"; //NON-NLS private static final String NAME_RULE_TAG = "NAME"; //NON-NLS
private static final String UNNAMED_LEGACY_RULE_PREFIX = "Unnamed Rule "; // NON-NLS
private static final String NAME_ATTR = "name"; //NON-NLS private static final String NAME_ATTR = "name"; //NON-NLS
private static final String MIME_ATTR = "mimeType"; private static final String MIME_ATTR = "mimeType";
private static final String FS_COMPARATOR_ATTR = "comparatorSymbol"; private static final String FS_COMPARATOR_ATTR = "comparatorSymbol";
@ -80,7 +78,6 @@ class InterestingItemsFilesSetSettings implements Serializable {
private static final String TYPE_FILTER_VALUE_FILES = "file"; //NON-NLS private static final String TYPE_FILTER_VALUE_FILES = "file"; //NON-NLS
private static final String XML_ENCODING = "UTF-8"; //NON-NLS private static final String XML_ENCODING = "UTF-8"; //NON-NLS
private static final Logger logger = Logger.getLogger(InterestingItemsFilesSetSettings.class.getName()); private static final Logger logger = Logger.getLogger(InterestingItemsFilesSetSettings.class.getName());
private static int unnamedLegacyRuleCounter;
private static final String TYPE_FILTER_ATTR = "typeFilter"; //NON-NLS private static final String TYPE_FILTER_ATTR = "typeFilter"; //NON-NLS
private static final String EXTENSION_RULE_TAG = "EXTENSION"; //NON-NLS private static final String EXTENSION_RULE_TAG = "EXTENSION"; //NON-NLS
@ -106,7 +103,7 @@ class InterestingItemsFilesSetSettings implements Serializable {
*/ */
private static String readRuleName(Element elem) { private static String readRuleName(Element elem) {
// The rule must have a name. // The rule must have a name.
String ruleName = elem.getAttribute(InterestingItemsFilesSetSettings.NAME_ATTR); String ruleName = elem.getAttribute(NAME_ATTR);
return ruleName; return ruleName;
} }
@ -144,26 +141,27 @@ class InterestingItemsFilesSetSettings implements Serializable {
* *
* @return The path condition, or null if there is an error (logged). * @return The path condition, or null if there is an error (logged).
*/ */
private static FilesSet.Rule.ParentPathCondition readPathCondition(Element ruleElement) { private static ParentPathCondition readPathCondition(Element ruleElement) throws FilesSetsManager.FilesSetsManagerException {
// Read in the optional path condition. Null is o.k., but if the attribute // Read in the optional path condition. Null is o.k., but if the attribute
// is there, be sure it is not malformed. // is there, be sure it is not malformed.
ParentPathCondition pathCondition = null; ParentPathCondition pathCondition = null;
if (!ruleElement.getAttribute(PATH_FILTER_ATTR).isEmpty() || !ruleElement.getAttribute(PATH_REGEX_ATTR).isEmpty()) { if (!ruleElement.getAttribute(PATH_FILTER_ATTR).isEmpty() || !ruleElement.getAttribute(PATH_REGEX_ATTR).isEmpty()) {
String path = ruleElement.getAttribute(InterestingItemsFilesSetSettings.PATH_FILTER_ATTR); String path = ruleElement.getAttribute(PATH_FILTER_ATTR);
String pathRegex = ruleElement.getAttribute(InterestingItemsFilesSetSettings.PATH_REGEX_ATTR); String pathRegex = ruleElement.getAttribute(PATH_REGEX_ATTR);
if (!pathRegex.isEmpty() && path.isEmpty()) { if (!pathRegex.isEmpty() && path.isEmpty()) {
try { try {
Pattern pattern = Pattern.compile(pathRegex); Pattern pattern = Pattern.compile(pathRegex);
pathCondition = new FilesSet.Rule.ParentPathCondition(pattern); pathCondition = new ParentPathCondition(pattern);
} catch (PatternSyntaxException ex) { } catch (PatternSyntaxException ex) {
logger.log(Level.SEVERE, "Error compiling " + InterestingItemsFilesSetSettings.PATH_REGEX_ATTR + " regex, ignoring malformed path condition definition", ex); // NON-NLS logger.log(Level.SEVERE, "Error compiling " + PATH_REGEX_ATTR + " regex, ignoring malformed path condition definition", ex); // NON-NLS
throw new FilesSetsManager.FilesSetsManagerException(String.format("error compiling %s regex", PATH_REGEX_ATTR), ex);
} }
} else if (!path.isEmpty() && pathRegex.isEmpty()) { } else if (!path.isEmpty() && pathRegex.isEmpty()) {
pathCondition = new FilesSet.Rule.ParentPathCondition(path); pathCondition = new ParentPathCondition(path);
} }
if (pathCondition == null) { if (pathCondition == null) {
// Malformed attribute. // Malformed attribute.
return null; throw new FilesSetsManager.FilesSetsManagerException(String.format("Error creating path condition for rule %s", readRuleName(ruleElement)));
} }
} }
return pathCondition; return pathCondition;
@ -186,7 +184,7 @@ class InterestingItemsFilesSetSettings implements Serializable {
} }
private static FilesSet.Rule readRule(Element elem) throws FilesSetsManager.FilesSetsManagerException { private static FilesSet.Rule readRule(Element elem) throws FilesSetsManager.FilesSetsManagerException {
String ruleName = InterestingItemsFilesSetSettings.readRuleName(elem); String ruleName = readRuleName(elem);
FileNameCondition nameCondition = readNameCondition(elem); FileNameCondition nameCondition = readNameCondition(elem);
MetaTypeCondition metaCondition = readMetaTypeCondition(elem); MetaTypeCondition metaCondition = readMetaTypeCondition(elem);
ParentPathCondition pathCondition = readPathCondition(elem); ParentPathCondition pathCondition = readPathCondition(elem);
@ -200,7 +198,7 @@ class InterestingItemsFilesSetSettings implements Serializable {
return new FilesSet.Rule(ruleName, nameCondition, metaCondition, pathCondition, mimeCondition, sizeCondition); return new FilesSet.Rule(ruleName, nameCondition, metaCondition, pathCondition, mimeCondition, sizeCondition);
} }
private static FileNameCondition readNameCondition(Element elem) { private static FileNameCondition readNameCondition(Element elem) throws FilesSetsManager.FilesSetsManagerException {
FileNameCondition nameCondition = null; FileNameCondition nameCondition = null;
String content = elem.getTextContent(); String content = elem.getTextContent();
String regex = elem.getAttribute(REGEX_ATTR); String regex = elem.getAttribute(REGEX_ATTR);
@ -213,17 +211,17 @@ class InterestingItemsFilesSetSettings implements Serializable {
} else if (elem.getTagName().equals(EXTENSION_RULE_TAG)) { } else if (elem.getTagName().equals(EXTENSION_RULE_TAG)) {
nameCondition = new FilesSet.Rule.ExtensionCondition(pattern); nameCondition = new FilesSet.Rule.ExtensionCondition(pattern);
} else { } else {
return null; throw new FilesSetsManager.FilesSetsManagerException(String.format("Name condition has invalid tag name of %s for rule %s", elem.getTagName(), readRuleName(elem)));
} }
} else { } else {
logger.log(Level.SEVERE, "Error compiling " + elem.getTagName() + " regex, ignoring malformed '{0}' rule definition", readRuleName(elem)); // NON-NLS logger.log(Level.SEVERE, "Error compiling " + elem.getTagName() + " regex, ignoring malformed '{0}' rule definition", readRuleName(elem)); // NON-NLS
return null; throw new FilesSetsManager.FilesSetsManagerException(String.format("error compiling %s regex in rule %s", REGEX_ATTR, readRuleName(elem)));
} }
} else { } else {
for (String illegalChar : illegalFileNameChars) { for (String illegalChar : illegalFileNameChars) {
if (content.contains(illegalChar)) { if (content.contains(illegalChar)) {
logger.log(Level.SEVERE, elem.getTagName() + " content has illegal chars, ignoring malformed '{0}' rule definition", new Object[]{elem.getTagName(), readRuleName(elem)}); // NON-NLS logger.log(Level.SEVERE, elem.getTagName() + " content has illegal chars, ignoring malformed '{0}' rule definition", new Object[]{elem.getTagName(), readRuleName(elem)}); // NON-NLS
return null; throw new FilesSetsManager.FilesSetsManagerException(String.format("File name has illegal character of %s in rule %s", illegalChar, readRuleName(elem)));
} }
} }
if (elem.getTagName().equals(NAME_RULE_TAG)) { if (elem.getTagName().equals(NAME_RULE_TAG)) {
@ -262,6 +260,10 @@ class InterestingItemsFilesSetSettings implements Serializable {
logger.log(Level.SEVERE, "Invalid Comparator symbol or Size Unit set in FilesSet xml, unable to create FileSizeCondition for rule: " + readRuleName(elem), iaEx); logger.log(Level.SEVERE, "Invalid Comparator symbol or Size Unit set in FilesSet xml, unable to create FileSizeCondition for rule: " + readRuleName(elem), iaEx);
throw new FilesSetsManager.FilesSetsManagerException(String.format("Invalid Comparator or Size unit in FilesSet XML for rule %s", readRuleName(elem)), iaEx); throw new FilesSetsManager.FilesSetsManagerException(String.format("Invalid Comparator or Size unit in FilesSet XML for rule %s", readRuleName(elem)), iaEx);
} }
} //if all of them aren't populated but some of them are this is a malformed xml
else if (!elem.getAttribute(FS_COMPARATOR_ATTR).isEmpty() || !elem.getAttribute(FS_SIZE_ATTR).isEmpty() || !elem.getAttribute(FS_UNITS_ATTR).isEmpty()) {
logger.log(Level.SEVERE, "Invalid Comparator symbol or Size Unit set in FilesSet xml, unable to create FileSizeCondition for rule: " + readRuleName(elem));
throw new FilesSetsManager.FilesSetsManagerException(String.format("XML malformed missing at least one fileSize attribute for rule %s", readRuleName(elem)));
} }
return sizeCondition; return sizeCondition;
} }
@ -275,9 +277,9 @@ class InterestingItemsFilesSetSettings implements Serializable {
*/ */
private static void readFilesSet(Element setElem, Map<String, FilesSet> filesSets, String filePath) throws FilesSetsManager.FilesSetsManagerException { private static void readFilesSet(Element setElem, Map<String, FilesSet> filesSets, String filePath) throws FilesSetsManager.FilesSetsManagerException {
// The file set must have a unique name. // The file set must have a unique name.
String setName = setElem.getAttribute(InterestingItemsFilesSetSettings.NAME_ATTR); String setName = setElem.getAttribute(NAME_ATTR);
if (setName.isEmpty()) { if (setName.isEmpty()) {
logger.log(Level.SEVERE, "Found {0} element without required {1} attribute, ignoring malformed file set definition in FilesSet definition file at {2}", new Object[]{InterestingItemsFilesSetSettings.FILE_SET_TAG, InterestingItemsFilesSetSettings.NAME_ATTR, filePath}); // NON-NLS logger.log(Level.SEVERE, "Found {0} element without required {1} attribute, ignoring malformed file set definition in FilesSet definition file at {2}", new Object[]{FILE_SET_TAG, NAME_ATTR, filePath}); // NON-NLS
return; return;
} }
if (filesSets.containsKey(setName)) { if (filesSets.containsKey(setName)) {
@ -285,23 +287,22 @@ class InterestingItemsFilesSetSettings implements Serializable {
return; return;
} }
// The file set may have a description. The empty string is o.k. // The file set may have a description. The empty string is o.k.
String description = setElem.getAttribute(InterestingItemsFilesSetSettings.DESC_ATTR); String description = setElem.getAttribute(DESC_ATTR);
// The file set may or may not ignore known files. The default behavior // The file set may or may not ignore known files. The default behavior
// is to not ignore them. // is to not ignore them.
String ignoreKnown = setElem.getAttribute(InterestingItemsFilesSetSettings.IGNORE_KNOWN_FILES_ATTR); String ignoreKnown = setElem.getAttribute(IGNORE_KNOWN_FILES_ATTR);
boolean ignoreKnownFiles = false; boolean ignoreKnownFiles = false;
if (!ignoreKnown.isEmpty()) { if (!ignoreKnown.isEmpty()) {
ignoreKnownFiles = Boolean.parseBoolean(ignoreKnown); ignoreKnownFiles = Boolean.parseBoolean(ignoreKnown);
} }
// The file set may or may not skip unallocated space. The default behavior // The file set may or may not skip unallocated space. The default behavior
// is not to skip it. // is not to skip it.
String ignoreUnallocated = setElem.getAttribute(InterestingItemsFilesSetSettings.IGNORE_UNALLOCATED_SPACE); String ignoreUnallocated = setElem.getAttribute(IGNORE_UNALLOCATED_SPACE);
boolean ignoreUnallocatedSpace = false; boolean ignoreUnallocatedSpace = false;
if (!ignoreUnallocated.isEmpty()) { if (!ignoreUnallocated.isEmpty()) {
ignoreUnallocatedSpace = Boolean.parseBoolean(ignoreUnallocated); ignoreUnallocatedSpace = Boolean.parseBoolean(ignoreUnallocated);
} }
// Read the set membership rules, if any. // Read the set membership rules, if any.
InterestingItemsFilesSetSettings.unnamedLegacyRuleCounter = 1;
Map<String, FilesSet.Rule> rules = new HashMap<>(); Map<String, FilesSet.Rule> rules = new HashMap<>();
NodeList allRuleElems = setElem.getChildNodes(); NodeList allRuleElems = setElem.getChildNodes();
for (int j = 0; j < allRuleElems.getLength(); ++j) { for (int j = 0; j < allRuleElems.getLength(); ++j) {
@ -384,7 +385,7 @@ class InterestingItemsFilesSetSettings implements Serializable {
// Get the root element. // Get the root element.
Element root = doc.getDocumentElement(); Element root = doc.getDocumentElement();
if (root == null) { if (root == null) {
logger.log(Level.SEVERE, "Failed to get root {0} element tag of FilesSet definition file at {1}", new Object[]{InterestingItemsFilesSetSettings.FILE_SETS_ROOT_TAG, xmlFile.getPath()}); // NON-NLS logger.log(Level.SEVERE, "Failed to get root {0} element tag of FilesSet definition file at {1}", new Object[]{FILE_SETS_ROOT_TAG, xmlFile.getPath()}); // NON-NLS
return filesSets; return filesSets;
} }
// Read in the files set definitions. // Read in the files set definitions.
@ -508,38 +509,34 @@ class InterestingItemsFilesSetSettings implements Serializable {
* *
* @return The meta-type condition, or null if there is an error (logged). * @return The meta-type condition, or null if there is an error (logged).
*/ */
private static FilesSet.Rule.MetaTypeCondition readMetaTypeCondition(Element ruleElement) { private static MetaTypeCondition readMetaTypeCondition(Element ruleElement) throws FilesSetsManager.FilesSetsManagerException {
FilesSet.Rule.MetaTypeCondition metaCondition = null; MetaTypeCondition metaCondition = null;
// The rule must have a meta-type condition, unless a TSK Framework // The rule must have a meta-type condition, unless a TSK Framework
// definitions file is being read. // definitions file is being read.
if (!ruleElement.getAttribute(TYPE_FILTER_ATTR).isEmpty()) { if (!ruleElement.getAttribute(TYPE_FILTER_ATTR).isEmpty()) {
String conditionAttribute = ruleElement.getAttribute(InterestingItemsFilesSetSettings.TYPE_FILTER_ATTR); String conditionAttribute = ruleElement.getAttribute(TYPE_FILTER_ATTR);
if (!conditionAttribute.isEmpty()) { if (!conditionAttribute.isEmpty()) {
switch (conditionAttribute) { switch (conditionAttribute) {
case TYPE_FILTER_VALUE_FILES: case TYPE_FILTER_VALUE_FILES:
metaCondition = new FilesSet.Rule.MetaTypeCondition(FilesSet.Rule.MetaTypeCondition.Type.FILES); metaCondition = new MetaTypeCondition(MetaTypeCondition.Type.FILES);
break; break;
case TYPE_FILTER_VALUE_DIRS: case TYPE_FILTER_VALUE_DIRS:
metaCondition = new FilesSet.Rule.MetaTypeCondition(FilesSet.Rule.MetaTypeCondition.Type.DIRECTORIES); metaCondition = new MetaTypeCondition(MetaTypeCondition.Type.DIRECTORIES);
break; break;
case TYPE_FILTER_VALUE_ALL: case TYPE_FILTER_VALUE_ALL:
case TYPE_FILTER_VALUE_FILES_AND_DIRS: //converts legacy xmls to current metaCondition terms case TYPE_FILTER_VALUE_FILES_AND_DIRS: //converts legacy xmls to current metaCondition terms
metaCondition = new FilesSet.Rule.MetaTypeCondition(FilesSet.Rule.MetaTypeCondition.Type.ALL); metaCondition = new MetaTypeCondition(MetaTypeCondition.Type.ALL);
break; break;
default: default:
logger.log(Level.SEVERE, "Found {0} " + InterestingItemsFilesSetSettings.TYPE_FILTER_ATTR + " attribute with unrecognized value ''{0}'', ignoring malformed rule definition", conditionAttribute); // NON-NLS logger.log(Level.SEVERE, "Found {0} " + TYPE_FILTER_ATTR + " attribute with unrecognized value ''{0}'', ignoring malformed rule definition", conditionAttribute); // NON-NLS
break; // Malformed attribute.
throw new FilesSetsManager.FilesSetsManagerException(String.format("Malformed XML for Metatype condition, %s, in rule %s", conditionAttribute, readRuleName(ruleElement)));
}
} }
} else {
// Accept TSK Framework FilesSet definitions,
// default to files.
metaCondition = new FilesSet.Rule.MetaTypeCondition(FilesSet.Rule.MetaTypeCondition.Type.FILES);
} }
if (metaCondition == null) { if (metaCondition == null) {
// Malformed attribute. // Accept TSK Framework FilesSet definitions,
return null; // default to files.
}
} else {
metaCondition = new MetaTypeCondition(MetaTypeCondition.Type.FILES); metaCondition = new MetaTypeCondition(MetaTypeCondition.Type.FILES);
} }
return metaCondition; return metaCondition;