From 9dcd37a0087e8b195e8456c40ac96b38c7c52dcb Mon Sep 17 00:00:00 2001 From: "Samuel H. Kenyon" Date: Wed, 30 Apr 2014 16:34:10 -0400 Subject: [PATCH] make sure to add all attributes for an artifact from XML, not just one --- .../ExternalResultsIngestModule.java | 2 +- .../ExternalResultsUtility.java | 52 +++++++++++-------- .../modules/externalresults/ResultsData.java | 15 +++--- 3 files changed, 38 insertions(+), 31 deletions(-) diff --git a/Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsIngestModule.java b/Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsIngestModule.java index 5017429cbc..92ae219f96 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsIngestModule.java +++ b/Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsIngestModule.java @@ -78,7 +78,7 @@ public class ExternalResultsIngestModule extends IngestModuleAdapter implements } ///@todo use a standard name or search for an XML file - importFilePath = importPath + File.separator + "ext-test6.xml"; + importFilePath = importPath + File.separator + "ext-test5multi.xml"; } } diff --git a/Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsUtility.java b/Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsUtility.java index 67bf656167..c7b55c4519 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsUtility.java +++ b/Core/src/org/sleuthkit/autopsy/modules/externalresults/ExternalResultsUtility.java @@ -23,6 +23,7 @@ package org.sleuthkit.autopsy.modules.externalresults; import java.util.ArrayList; import java.util.Collection; import java.util.List; +import java.util.Set; import java.util.logging.Level; import org.sleuthkit.autopsy.casemodule.Case; import org.sleuthkit.autopsy.coreutils.Logger; @@ -63,7 +64,6 @@ public class ExternalResultsUtility { Collection bbAttributes = new ArrayList<>(); for (ResultsData.AttributeData attr : art.attributes) { - BlackboardAttribute bbAttr = null; int bbAttrTypeId; BlackboardAttribute.ATTRIBUTE_TYPE stdAttrType = isStandardAttributeType(attr.typeStr); if (stdAttrType != null) { @@ -73,28 +73,34 @@ public class ExternalResultsUtility { bbAttrTypeId = Case.getCurrentCase().getSleuthkitCase().addAttrType(attr.typeStr, attr.typeStr); } - switch (attr.valueType) { - case "text": //NON-NLS - bbAttr = new BlackboardAttribute(bbAttrTypeId, attr.source, attr.context, attr.valueStr); - break; - case "int32": //NON-NLS - int intValue = Integer.parseInt(attr.valueStr); - bbAttr = new BlackboardAttribute(bbAttrTypeId, attr.source, attr.context, intValue); - break; - case "int64": //NON-NLS - long longValue = Long.parseLong(attr.valueStr); - bbAttr = new BlackboardAttribute(bbAttrTypeId, attr.source, attr.context, longValue); - break; - case "double": //NON-NLS - double doubleValue = Double.parseDouble(attr.valueStr); - bbAttr = new BlackboardAttribute(bbAttrTypeId, attr.source, attr.context, doubleValue); - break; - default: - logger.log(Level.WARNING, "Ignoring invalid attribute value type " + attr.valueType); - break; - } - if (bbAttr != null) { - bbAttributes.add(bbAttr); + // Add all attribute values + Set valueTypes = attr.valueStr.keySet(); + for (String valueType : valueTypes) { + String valueString = attr.valueStr.get(valueType); + BlackboardAttribute bbAttr = null; + switch (valueType) { + case "text": //NON-NLS + bbAttr = new BlackboardAttribute(bbAttrTypeId, attr.source, attr.context, valueString); + break; + case "int32": //NON-NLS + int intValue = Integer.parseInt(valueString); + bbAttr = new BlackboardAttribute(bbAttrTypeId, attr.source, attr.context, intValue); + break; + case "int64": //NON-NLS + long longValue = Long.parseLong(valueString); + bbAttr = new BlackboardAttribute(bbAttrTypeId, attr.source, attr.context, longValue); + break; + case "double": //NON-NLS + double doubleValue = Double.parseDouble(valueString); + bbAttr = new BlackboardAttribute(bbAttrTypeId, attr.source, attr.context, doubleValue); + break; + default: + logger.log(Level.WARNING, "Ignoring invalid attribute value type " + valueType); + break; + } + if (bbAttr != null) { + bbAttributes.add(bbAttr); + } } } diff --git a/Core/src/org/sleuthkit/autopsy/modules/externalresults/ResultsData.java b/Core/src/org/sleuthkit/autopsy/modules/externalresults/ResultsData.java index 5a872a5ec9..69c41e1a76 100644 --- a/Core/src/org/sleuthkit/autopsy/modules/externalresults/ResultsData.java +++ b/Core/src/org/sleuthkit/autopsy/modules/externalresults/ResultsData.java @@ -21,6 +21,7 @@ package org.sleuthkit.autopsy.modules.externalresults; import java.util.ArrayList; +import java.util.HashMap; import java.util.List; /** @@ -69,11 +70,11 @@ public class ResultsData { public void addAttributeValue(int artIndex, int attrIndex, String valueStr, String valueType) { ArtifactData art = artifacts.get(artIndex); - AttributeData attr = art.attributes.get(attrIndex); - attr.valueStr = valueStr; - if (!valueType.isEmpty()) { - attr.valueType = valueType; + AttributeData attr = art.attributes.get(attrIndex); + if (valueType.isEmpty()) { + valueType = AttributeData.DEFAULT_VALUE_TYPE; } + attr.valueStr.put(valueType, valueStr); } public void addAttributeSource(int artIndex, int attrIndex, String source) { @@ -119,9 +120,9 @@ public class ResultsData { } public static class AttributeData { - public String typeStr; - public String valueType = "text"; //default if not specified - public String valueStr; //valueType determines how to interpret it + public static final String DEFAULT_VALUE_TYPE = "text"; + public String typeStr; + public HashMap valueStr = new HashMap<>(); //valueType determines how to interpret valueStr public String source; public String context; }