Repository navigation
Fix command type on an unclosed quote - #242
Conversation
Text with an unbalanced quote made shlex.split raise a ValueError when the record was created. Producers that build records from log text, for example the Defender MPLog plugin of dissect.target, stopped at the first such line and lost the rest of the file. Fall back to splitting on whitespace so the record is still created and keeps its text. Fixes fox-it#241
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #242 +/- ##
==========================================
+ Coverage 84.29% 84.30% +0.01%
==========================================
Files 35 35
Lines 3756 3759 +3
==========================================
+ Hits 3166 3169 +3
Misses 590 590
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
@Che4ter thank you for your contribution! As this is your first code contribution, please read the following Contributor License Agreement (CLA). If you agree with the CLA, please reply with the following information:
Contributor License Agreement
Contribution License AgreementThis Contribution License Agreement ("Agreement") governs your Contribution(s) (as defined below) and conveys certain license rights to Fox-IT B.V. ("Fox-IT") for your Contribution(s) to Fox-IT"s open source Dissect project. This Agreement covers any and all Contributions that you ("You" or "Your"), now or in the future, Submit (as defined below) to this project. This Agreement is between Fox-IT B.V. and You and takes effect when you click an “I Accept” button, check box presented with these terms, otherwise accept these terms or, if earlier, when You Submit a Contribution.
|
|
LGTM, but the CLA needs to be accepted before I can merge it |
|
@DissectBot agree [company="baseVision AG"] |
Text with an unbalanced quote made shlex.split raise a ValueError when
a command record was created. Producers that build records from log
text, for example the Defender MPLog plugin of dissect.target, stopped
at the first such line and lost the rest of the file.
Reproduce (flow.record main):
Change: if shlex.split fails, fall back to splitting on whitespace, so
the record is still created and keeps its text. Input that parses today
is unchanged, because the fallback only runs where it used to raise.
Tests: two new cases, one in test_command_windows and one in
test_command_posix (tests/fieldtypes/test_fieldtypes.py). Without the
change they fail with the ValueError above; with it they pass. ruff
check and ruff format --check are clean.
Fixes #241