mstoeck3/autopsy-flatpak
1
0
Fork 0
mirror of https://github.com/overcuriousity/autopsy-flatpak.git synced 2025-07-17 18:17:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix luhn check and make TSK_ACCOUNT artifact

Browse Source
This commit is contained in:
jmillman 2016-07-14 11:54:24 -04:00
parent 29d892d352
commit dd5ad3e91c
1 changed files with 18 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
KeywordSearch/src/org/sleuthkit/autopsy/keywordsearch/TermComponentQuery.java
View File

@ -91,7 +91,7 @@ final class TermComponentQuery implements KeywordSearchQuery {
+ "(?:\\?" // end sentinal: ? //NON-NLS + "(?:\\?" // end sentinal: ? //NON-NLS
+ "(?<LRC>.)" //longitudinal redundancy check //NON-NLS + "(?<LRC>.)" //longitudinal redundancy check //NON-NLS
+ "?)?)?)?)?)?");//close nested optional groups //NON-NLS + "?)?)?)?)?)?");//close nested optional groups //NON-NLS
private static final Pattern CCN_PATTERN = Pattern.compile("(?<ccn>\\d{12,19})");
private static final LuhnCheckDigit LUHN_CHECK = new LuhnCheckDigit(); private static final LuhnCheckDigit LUHN_CHECK = new LuhnCheckDigit();
//corresponds to field in Solr schema, analyzed with white-space tokenizer only //corresponds to field in Solr schema, analyzed with white-space tokenizer only
@ -235,11 +235,13 @@ final class TermComponentQuery implements KeywordSearchQuery {
@Override @Override
public KeywordCachedArtifact writeSingleFileHitsToBlackBoard(String termHit, KeywordHit hit, String snippet, String listName) { public KeywordCachedArtifact writeSingleFileHitsToBlackBoard(String termHit, KeywordHit hit, String snippet, String listName) {
try { try {
BlackboardArtifact bba = hit.getContent().newArtifact(ARTIFACT_TYPE.TSK_KEYWORD_HIT);; BlackboardArtifact bba;
Collection<BlackboardAttribute> attributes = new ArrayList<>(); Collection<BlackboardAttribute> attributes = new ArrayList<>();
//if the keyword hit matched the credit card number keyword/regex... //if the keyword hit matched the credit card number keyword/regex...
if (keyword.getType() == ATTRIBUTE_TYPE.TSK_CREDIT_CARD_NUMBER) { if (keyword.getType() == ATTRIBUTE_TYPE.TSK_CREDIT_CARD_NUMBER) {
bba = hit.getContent().newArtifact(ARTIFACT_TYPE.TSK_ACCOUNT);
//TODO: make account artifact //TODO: make account artifact
//try to match it against the track 1 regex //try to match it against the track 1 regex
Matcher matcher = TRACK1_PATTERN.matcher(hit.getSnippet()); Matcher matcher = TRACK1_PATTERN.matcher(hit.getSnippet());
@ -253,8 +255,7 @@ final class TermComponentQuery implements KeywordSearchQuery {
} }
} else { } else {
//TODO: keyword hit artifact //TODO: keyword hit artifact
} bba = hit.getContent().newArtifact(ARTIFACT_TYPE.TSK_KEYWORD_HIT);
//TODO: move most of the following into the if branch for non-account keyword hits //TODO: move most of the following into the if branch for non-account keyword hits
//regex match //regex match
attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_KEYWORD, MODULE_NAME, termHit)); attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_KEYWORD, MODULE_NAME, termHit));
@ -265,6 +266,8 @@ final class TermComponentQuery implements KeywordSearchQuery {
//regex keyword //regex keyword
attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_KEYWORD_REGEXP, MODULE_NAME, keyword.getQuery())); attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_KEYWORD_REGEXP, MODULE_NAME, keyword.getQuery()));
}
//preview //preview
if (snippet != null) { if (snippet != null) {
attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW, MODULE_NAME, snippet)); attributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_KEYWORD_PREVIEW, MODULE_NAME, snippet));
@ -329,7 +332,9 @@ final class TermComponentQuery implements KeywordSearchQuery {
if (keyword.getType() == ATTRIBUTE_TYPE.TSK_CREDIT_CARD_NUMBER) { if (keyword.getType() == ATTRIBUTE_TYPE.TSK_CREDIT_CARD_NUMBER) {
//If the keyword is a credit card number, pass it through luhn validator //If the keyword is a credit card number, pass it through luhn validator
if (false == LUHN_CHECK.isValid(term.getTerm())) { Matcher matcher = CCN_PATTERN.matcher(term.getTerm());
matcher.find();
if (false == LUHN_CHECK.isValid(matcher.group("ccn"))) {
continue; //if the hit does not pass the luhn check, skip it. continue; //if the hit does not pass the luhn check, skip it.
} }
} }