assemblyline 4.7.5.dev39__tar.gz → 4.7.5.dev40__tar.gz

{assemblyline-4.7.5.dev39/assemblyline.egg-info → assemblyline-4.7.5.dev40}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: assemblyline
-Version: 4.7.5.dev39
+Version: 4.7.5.dev40
 Summary: Assemblyline 4 - Automated malware analysis framework
 Home-page: https://github.com/CybercentreCanada/assemblyline-base
 Author: CCCS Assemblyline development team

assemblyline-4.7.5.dev40/assemblyline/VERSION

@@ -0,0 +1 @@
+4.7.5.dev40

{assemblyline-4.7.5.dev39 → assemblyline-4.7.5.dev40}/assemblyline/odm/base.py

@@ -846,23 +846,71 @@ class TypedList(list):
     def __init__(self, type_p, *items, **kwargs):
         super().__init__([type_p.check(el, **kwargs) for el in items])
         self.type = type_p
+        self._set_cache: typing.Optional[frozenset] = None
+        # Assume that the list is hashable until proven otherwise. This is an optimization to avoid creating a frozenset for every list.
+        self._unhashable: bool = False
+
+    def _invalidate_cache(self):
+        self._set_cache = None
+
+    def __contains__(self, item):
+        if self._unhashable:
+            # If unhashable, fallback to legacy list scan.
+            return super().__contains__(item)
+
+        if self._set_cache is None:
+            try:
+                self._set_cache = frozenset(self)
+            except TypeError:
+                # Elements are not hashable (e.g. compound objects); fall back to list scan
+                self._unhashable = True
+                return super().__contains__(item)
+        return item in self._set_cache
 
     def append(self, item):
+        self._invalidate_cache()
         super().append(self.type.check(item))
 
     def extend(self, sequence):
+        self._invalidate_cache()
         super().extend(self.type.check(item) for item in sequence)
 
     def insert(self, index, item):
+        self._invalidate_cache()
         super().insert(index, self.type.check(item))
 
     def __setitem__(self, index, item):
+        self._invalidate_cache()
         if isinstance(index, slice):
             item = [self.type.check(val) for val in item]
             super().__setitem__(index, item)
         else:
             super().__setitem__(index, self.type.check(item))
 
+    def __delitem__(self, index):
+        self._invalidate_cache()
+        super().__delitem__(index)
+
+    def remove(self, item):
+        self._invalidate_cache()
+        super().remove(item)
+
+    def pop(self, index=-1):
+        self._invalidate_cache()
+        return super().pop(index)
+
+    def clear(self):
+        self._invalidate_cache()
+        super().clear()
+
+    def __iadd__(self, other):
+        self._invalidate_cache()
+        return super().__iadd__(other)
+
+    def __imul__(self, n):
+        self._invalidate_cache()
+        return super().__imul__(n)
+
 
 class List(_Field):
     """A field storing a sequence of typed elements."""

{assemblyline-4.7.5.dev39 → assemblyline-4.7.5.dev40}/assemblyline/odm/models/config.py

@@ -2,6 +2,7 @@ from typing import Any, Dict, List
 
 from assemblyline import odm
 from assemblyline.common.constants import PRIORITIES
+from assemblyline.odm.base import DOMAIN_REGEX, IP_REGEX
 from assemblyline.common.forge import get_classification
 from assemblyline.odm.models.service import EnvironmentVariable
 from assemblyline.odm.models.service_delta import DockerConfigDelta
@@ -40,6 +41,8 @@ DEFAULT_PASSWORD_REQUIREMENTS = {
 }
 
 CIDR_REGEX = r"^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\/(?:3[0-2]|[12]?[0-9])$"
+# Domain (optionally prefixed with '*.' to match subdomains), single-label intranet host, or IP
+AVATAR_HOST_REGEX = f"^(?:(?:\\*\\.)?{DOMAIN_REGEX}|[A-Za-z0-9](?:[A-Za-z0-9-]{{0,61}}[A-Za-z0-9])?|{IP_REGEX})$"
 
 @odm.model(index=False, store=False,
            description="Configuration block for [GC Notify](https://notification.canada.ca/) signup and password reset")
@@ -187,6 +190,11 @@ class OAuthProvider(odm.Model):
     auto_properties: List[AutoProperty] = odm.List(odm.Compound(AutoProperty), default=[],
                                                    description="Automatic role and classification assignments")
     app_provider: AppProvider = odm.Optional(odm.Compound(AppProvider))
+    avatar_allowed_hosts: List[str] = odm.List(
+        odm.ValidatedKeyword(AVATAR_HOST_REGEX), default=[],
+        description="Hosts from which user avatars may be downloaded. Entries match the URL hostname "
+                    "exactly, or a subdomain when prefixed with '*.' (e.g. '*.googleusercontent.com'). "
+                                                         "The host of `api_base_url` is always allowed.")
     ip_filter: List[str] = odm.Optional(odm.List(odm.ValidatedKeyword(CIDR_REGEX)),
                                         description="List of CIDRs allowed to access internal authentication")
     uid_randomize: bool = odm.Boolean(default=False,

{assemblyline-4.7.5.dev39 → assemblyline-4.7.5.dev40}/assemblyline/odm/models/ontology/filetypes/pe.py

@@ -157,6 +157,23 @@ class PE(odm.Model):
             entries = odm.Optional(odm.List(odm.Compound(Entry)))
             signature = odm.Optional(odm.EmptyableKeyword(copyto="__text__"))
 
+        @odm.model(index=True, store=False)
+        class Repro(odm.Model):
+            hash = odm.Optional(odm.EmptyableKeyword(copyto="__text__"))
+
+        @odm.model(index=True, store=False)
+        class VCFeature(odm.Model):
+            c_cpp = odm.Optional(odm.Integer())
+            pre_vcpp = odm.Optional(odm.Integer())
+            gs = odm.Optional(odm.Integer())
+            sdl = odm.Optional(odm.Integer())
+            guards = odm.Optional(odm.Integer())
+
+        @odm.model(index=True, store=False)
+        class PDBChecksum(odm.Model):
+            algorithm = odm.Optional(odm.EmptyableKeyword(copyto="__text__"))
+            hash = odm.Optional(odm.EmptyableKeyword(copyto="__text__"))
+
         addressof_rawdata = odm.Optional(odm.Integer())
         characteristics = odm.Optional(odm.Integer())
         major_version = odm.Optional(odm.Integer())
@@ -168,6 +185,10 @@ class PE(odm.Model):
         type = odm.Optional(odm.EmptyableKeyword(copyto="__text__"))
         code_view = odm.Optional(odm.Compound(CodeView))
         pogo = odm.Optional(odm.Compound(POGO))
+        repro = odm.Optional(odm.Compound(Repro))
+        vc_feature = odm.Optional(odm.Compound(VCFeature))
+        ex_dll_characteristics = odm.Optional(odm.List(odm.EmptyableKeyword(copyto="__text__")))
+        pdb_checksum = odm.Optional(odm.Compound(PDBChecksum))
 
     @odm.model(index=True, store=False)
     class Export(odm.Model):
@@ -182,6 +203,7 @@ class PE(odm.Model):
             forward_information = odm.Optional(odm.Compound(Forward_Information))
             function_rva = odm.Optional(odm.Integer())
             is_extern = odm.Optional(odm.Boolean())
+            is_forwarded = odm.Optional(odm.Boolean())
             name = odm.Optional(odm.EmptyableKeyword(copyto="__text__"))
             ordinal = odm.Optional(odm.Integer())
 
@@ -258,6 +280,16 @@ class PE(odm.Model):
         hotpatch_table_offset = odm.Optional(odm.Integer())
         addressof_unicode_string = odm.Optional(odm.Integer())
         reserved3 = odm.Optional(odm.Integer())
+        enclave_configuration_ptr = odm.Optional(odm.Integer())
+        volatile_metadata_pointer = odm.Optional(odm.Integer())
+        guard_eh_continuation_count = odm.Optional(odm.Integer())
+        guard_eh_continuation_table = odm.Optional(odm.Integer())
+        guard_xfg_check_function_pointer = odm.Optional(odm.Integer())
+        guard_xfg_dispatch_function_pointer = odm.Optional(odm.Integer())
+        guard_xfg_table_dispatch_function_pointer = odm.Optional(odm.Integer())
+        cast_guard_os_determined_failure_mode = odm.Optional(odm.Integer())
+        guard_memcpy_function_pointer = odm.Optional(odm.Integer())
+        uma_function_pointers = odm.Optional(odm.Integer())
 
     @odm.model(index=True, store=False)
     class Resources_Manager(odm.Model):

{assemblyline-4.7.5.dev39 → assemblyline-4.7.5.dev40/assemblyline.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: assemblyline
-Version: 4.7.5.dev39
+Version: 4.7.5.dev40
 Summary: Assemblyline 4 - Automated malware analysis framework
 Home-page: https://github.com/CybercentreCanada/assemblyline-base
 Author: CCCS Assemblyline development team

assemblyline-4.7.5.dev39/assemblyline/VERSION

@@ -1 +0,0 @@
-4.7.5.dev39