Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def GetOutputClass(cls, name):
"""Retrieves the output class for a specific name.
Args:
name (str): name of the output module.
Returns:
type: output module class.
Raises:
KeyError: if there is no output class found with the supplied name.
ValueError: if name is not a string.
"""
if not isinstance(name, py2to3.STRING_TYPES):
raise ValueError('Name attribute is not a string.')
name = name.lower()
if name not in cls._output_classes:
raise KeyError(
'Name: [{0:s}] not registered as an output module.'.format(name))
return cls._output_classes[name]
event_values = event_data.CopyToDict()
security = event_values.get('security', None)
if security:
security_flags = []
for flag, description in iter(self._SECURITY_VALUES.items()):
if security & flag:
security_flags.append(description)
security_string = '0x{0:08x}: {1:s}'.format(
security, ','.join(security_flags))
event_values['security'] = security_string
for key, value in iter(event_values.items()):
if isinstance(value, py2to3.BYTES_TYPE):
event_values[key] = repr(value)
return self._ConditionalFormatMessages(event_values)
event_values = {}
for attribute_name, attribute_value in event_data.GetAttributes():
# TODO: remove regvalue, which is kept for backwards compatibility.
# Ignore the regvalue attribute as it cause issues when indexing.
if attribute_name == 'regvalue':
continue
if attribute_name == 'pathspec':
try:
attribute_value = JsonPathSpecSerializer.WriteSerialized(
attribute_value)
except TypeError:
continue
event_values[attribute_name] = attribute_value
if isinstance(attribute_value, py2to3.BYTES_TYPE):
# Some parsers have written bytes values to storage.
attribute_value = attribute_value.decode('utf-8', 'replace')
logger.warning(
'Found bytes value for attribute "{0:s}" for data type: '
'{1!s}. Value was converted to UTF-8: "{2:s}"'.format(
attribute_name, event_data.data_type, attribute_value))
event_values[attribute_name] = attribute_value
# Add a string representation of the timestamp.
try:
attribute_value = timelib.Timestamp.RoundToSeconds(event.timestamp)
except TypeError as exception:
logger.warning((
'Unable to round timestamp {0!s}. error: {1!s}. '
'Defaulting to 0').format(event.timestamp, exception))
attribute_value = 0
redirect_url = record_values.get('RedirectUrl', None)
sync_count = record_values.get('SyncCount', None)
url = record_values.get('Url', '')
# Ignore an URL that start with a binary value.
if ord(url[0]) < 0x20 or ord(url[0]) == 0x7f:
url = None
request_headers = record_values.get('RequestHeaders', None)
# Ignore non-Unicode request headers values.
if not isinstance(request_headers, py2to3.UNICODE_TYPE):
request_headers = None
response_headers = record_values.get('ResponseHeaders', None)
# Ignore non-Unicode response headers values.
if not isinstance(response_headers, py2to3.UNICODE_TYPE):
response_headers = None
event_data = MsieWebCacheContainerEventData()
event_data.access_count = access_count
event_data.cached_filename = cached_filename
event_data.cached_file_size = cached_file_size
event_data.cache_identifier = cache_identifier
event_data.container_identifier = container_identifier
event_data.entry_identifier = entry_identifier
event_data.file_extension = file_extension
event_data.redirect_url = redirect_url
event_data.request_headers = request_headers
event_data.response_headers = response_headers
event_data.sync_count = sync_count
event_data.url = url
def ReadUTF16(string_buffer):
"""Returns a decoded UTF-16 string from a string buffer.
Args:
string_buffer(bytes): byte string.
Returns:
str: Unicode string.
"""
if isinstance(string_buffer, (list, tuple)):
use_buffer = ''.join(string_buffer)
else:
use_buffer = string_buffer
if not isinstance(use_buffer, py2to3.BYTES_TYPE):
return ''
try:
return codecs.decode(use_buffer, 'utf-16').replace('\x00', '')
except SyntaxError as exception:
logging.error('Unable to decode string: {0:s} with error: {1!s}.'.format(
HexifyBuffer(string_buffer), exception))
except (UnicodeDecodeError, UnicodeEncodeError) as exception:
logging.error('Unable to decode string: {0:s} with error: {1!s}'.format(
HexifyBuffer(string_buffer), exception))
return codecs.decode(
use_buffer, 'utf-16', errors='ignore').replace('\x00', '')
This is a little complicated because of the necessity of supporting Python 2
and 3.
Args:
byte_stream (bytes): byte string.
offset (int): byte stream offset to check.
Returns:
bool: whether there's a UTF-16 null terminator in the stream at the given
offset.
"""
byte_1 = byte_stream[offset]
byte_2 = byte_stream[offset + 1]
if py2to3.PY_2 and byte_1 == b'\x00' and byte_2 == b'\x00':
return True
if py2to3.PY_3 and byte_1 == 0 and byte_2 == 0:
return True
return False
def _WriteOutputValues(self, output_values):
"""Writes values to the output.
Args:
output_values (list[str]): output values.
"""
for index, value in enumerate(output_values):
if not isinstance(value, py2to3.STRING_TYPES):
value = ''
output_values[index] = value.replace(',', ' ')
output_line = ','.join(output_values)
output_line = '{0:s}\n'.format(output_line)
self._output_writer.Write(output_line)
def HasOutputClass(cls, name):
"""Determines if a specific output class is registered with the manager.
Args:
name (str): name of the output module.
Returns:
bool: True if the output class is registered.
"""
if not isinstance(name, py2to3.STRING_TYPES):
return False
return name.lower() in cls._output_classes