Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def testInitialize(self):
"""Tests the __init__ function."""
source_type.WindowsRegistryValueSourceType(
key_value_pairs=[{'key': u'test', 'value': u'test'}])
with self.assertRaises(errors.FormatError):
source_type.WindowsRegistryValueSourceType(
key_value_pairs=[{'bad': u'test', 'value': u'test'}])
with self.assertRaises(errors.FormatError):
source_type.WindowsRegistryValueSourceType(
key_value_pairs={'bad': u'test', 'value': u'test'})
def ValidateKey(cls, key_path):
"""Validates this key against supported key names.
Args:
key_path (str): path of a Windows Registry key.
Raises:
FormatError: when key is not supported.
"""
for prefix in cls.VALID_PREFIXES:
if key_path.startswith(prefix):
return
# TODO: move check to validator.
if key_path.startswith('HKEY_CURRENT_USER\\'):
raise errors.FormatError(
'HKEY_CURRENT_USER\\ is not supported instead use: '
'HKEY_USERS\\%%users.sid%%\\')
raise errors.FormatError(
'Unupported Registry key path: {0:s}'.format(key_path))
def SupportedOS(self, art_definition):
supported_os = art_definition.get(
"supported_os", definitions.SUPPORTED_OS)
undefined_supported_os = set(supported_os).difference(
definitions.SUPPORTED_OS)
if undefined_supported_os:
raise errors.FormatError(
u'supported operating system: {} '
u'not defined.'.format(
u', '.join(undefined_supported_os)))
return supported_os
def _LoadDefinition(self, data):
if not isinstance(data, dict):
raise errors.FormatError(
"Artifact definition must be a dict.")
different_keys = set(data) - definitions.TOP_LEVEL_KEYS
if different_keys:
raise errors.FormatError(u'Undefined keys: {}'.format(
different_keys))
self._LoadFieldDefinitions(data, self._field_definitions)
key_value_pairs (Optional[list[tuple[str, str]]]): key path and value
name pairs, where key paths are relative to the root of the Windows
Registry.
Raises:
FormatError: when key value pairs is not set.
"""
if not key_value_pairs:
raise errors.FormatError('Missing key value pairs value.')
if not isinstance(key_value_pairs, list):
raise errors.FormatError('key_value_pairs must be a list')
for pair in key_value_pairs:
if not isinstance(pair, dict):
raise errors.FormatError('key_value_pair must be a dict')
if set(pair.keys()) != set(['key', 'value']):
key_value_pairs = ', '.join([
'{0:s}: {1:s}'.format(key, value) for key, value in key_value_pairs
])
error_message = (
'key_value_pair missing "key" and "value" keys, got: '
'{0:s}').format(key_value_pairs)
raise errors.FormatError(error_message)
WindowsRegistryKeySourceType.ValidateKey(pair['key'])
super(WindowsRegistryValueSourceType, self).__init__()
self.key_value_pairs = key_value_pairs
key_path (str): path of a Windows Registry key.
Raises:
FormatError: when key is not supported.
"""
for prefix in cls.VALID_PREFIXES:
if key_path.startswith(prefix):
return
# TODO: move check to validator.
if key_path.startswith('HKEY_CURRENT_USER\\'):
raise errors.FormatError(
'HKEY_CURRENT_USER\\ is not supported instead use: '
'HKEY_USERS\\%%users.sid%%\\')
raise errors.FormatError(
'Unupported Registry key path: {0:s}'.format(key_path))
def __init__(self, base_object=None, query=None):
"""Initializes a source type.
Args:
base_object (Optional[str]): WMI base object.
query (Optional[str]): WMI query.
Raises:
FormatError: when query is not set.
"""
if not query:
raise errors.FormatError('Missing query value.')
super(WMIQuerySourceType, self).__init__()
self.base_object = base_object
self.query = query
def BuildSources(self, art_definition):
sources = art_definition["sources"]
result = []
self.unsupported_source_types = []
for source in sources:
if not isinstance(source, dict):
raise errors.FormatError("Source is not a dict.")
source_type_name = source.get("type")
if source_type_name is None:
raise errors.FormatError("Source has no type.")
source_cls = self.source_types.get(source_type_name)
if source_cls:
result.append(source_cls(source, artifact=self))
else:
self.unsupported_source_types.append(source_type_name)
if not result:
if self.unsupported_source_types:
raise errors.FormatError(
"No supported sources: %s" % (
self.unsupported_source_types,))
raise errors.FormatError("No available sources.")
return result
Returns:
ArtifactDefinition: an artifact definition.
Raises:
FormatError: if the format of the artifact definition is not set
or incorrect.
"""
if not artifact_definition_values:
raise errors.FormatError('Missing artifact definition values.')
different_keys = (
set(artifact_definition_values) - definitions.TOP_LEVEL_KEYS)
if different_keys:
different_keys = ', '.join(different_keys)
raise errors.FormatError('Undefined keys: {0:s}'.format(different_keys))
name = artifact_definition_values.get('name', None)
if not name:
raise errors.FormatError('Invalid artifact definition missing name.')
# The description is assumed to be mandatory.
description = artifact_definition_values.get('doc', None)
if not description:
raise errors.FormatError(
'Invalid artifact definition: {0:s} missing description.'.format(
name))
artifact_definition = artifact.ArtifactDefinition(
name, description=description)
if artifact_definition_values.get('collectors', []):