dissect.target 3.20.dev27__tar.gz → 3.20.dev29__tar.gz

{dissect_target-3.20.dev27/dissect.target.egg-info → dissect_target-3.20.dev29}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev27
+Version: 3.20.dev29
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.dev27 → dissect_target-3.20.dev29}/dissect/target/helpers/configutil.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import io
 import json
+import logging
 import re
 import sys
 from collections import deque
@@ -47,6 +48,9 @@ except ImportError:
     HAS_TOML = False
 
 
+log = logging.getLogger(__name__)
+
+
 def _update_dictionary(current: dict[str, Any], key: str, value: Any) -> None:
     if prev_value := current.get(key):
         if isinstance(prev_value, dict):
@@ -465,6 +469,76 @@ class Toml(ConfigurationParser):
             raise ConfigurationParsingError("Failed to parse file, please install tomli.")
 
 
+class Env(ConfigurationParser):
+    """Parses ``.env`` file contents according to Docker and bash specification.
+
+    Does not apply interpolation of substituted values, eg. ``foo=${bar}`` and does not attempt
+    to parse list or dict strings. Does not support dynamic env files, eg. `` foo=`bar` ``. Also
+    does not support multi-line key/value assignments (yet).
+
+    Resources:
+        - https://docs.docker.com/compose/environment-variables/variable-interpolation/#env-file-syntax
+        - https://github.com/theskumar/python-dotenv/blob/main/src/dotenv/parser.py
+    """
+
+    RE_KV = re.compile(r"^(?P<key>.+?)=(?P<value>(\".+?\")|(\'.+?\')|(.*?))?(?P<comment> \#.+?)?$")
+
+    def __init__(self, comments: bool = True, *args, **kwargs) -> None:
+        super().__init__(*args, **kwargs)
+        self.comments = comments
+        self.parsed_data: dict | tuple[dict, str | None] = {}
+
+    def parse_file(self, fh: TextIO) -> None:
+        for line in fh.readlines():
+            # Blank lines are ignored.
+            # Lines beginning with ``#`` are processed as comments and ignored.
+            if not line or line[0] == "#" or "=" not in line:
+                continue
+
+            # Each line represents a key-value pair. Values can optionally be quoted.
+            # Inline comments for unquoted values must be preceded with a space.
+            # Value may be empty.
+            match = self.RE_KV.match(line)
+
+            # Line could be invalid
+            if not match:
+                log.warning("Could not parse line in %s: '%s'", fh, line)
+                continue
+
+            key = match.groupdict()["key"]
+            value = match.groupdict().get("value") or ""
+            value = value.strip()
+            comment = match.groupdict().get("comment")
+            comment = comment.replace(" # ", "", 1) if comment else None
+
+            # Surrounding whitespace characters are removed, unless quoted.
+            if value and ((value[0] == '"' and value[-1] == '"') or (value[0] == "'" and value[-1] == "'")):
+                is_quoted = True
+                value = value.strip("\"'")
+            else:
+                is_quoted = False
+                value = value.strip()
+
+            # Unquoted values may start with a quote if they are properly escaped.
+            if not is_quoted and value[:2] in ["\\'", '\\"']:
+                value = value[1:]
+
+            # Interpret boolean values
+            if value.lower() in ["1", "true"]:
+                value = True
+            elif value.lower() in ["0", "false"]:
+                value = False
+
+            # Interpret integer values
+            if isinstance(value, str) and re.match(r"^[0-9]{1,}$", value):
+                value = int(value)
+
+            if key.strip() in self.parsed_data:
+                log.warning("Duplicate environment key '%s' in file %s", key.strip(), fh)
+
+            self.parsed_data[key.strip()] = (value, comment) if self.comments else value
+
+
 class ScopeManager:
     """A (context)manager for dictionary scoping.
 

{dissect_target-3.20.dev27 → dissect_target-3.20.dev29}/dissect/target/helpers/regutil.py

@@ -3,9 +3,10 @@ from __future__ import annotations
 
 import fnmatch
 import re
-import struct
 from collections import defaultdict
 from datetime import datetime
+from enum import IntEnum
+from functools import cached_property
 from io import BytesIO
 from pathlib import Path
 from typing import BinaryIO, Iterator, Optional, TextIO, Union
@@ -28,6 +29,19 @@ ValueType = Union[int, str, bytes, list[str]]
 """The possible value types that can be returned from the registry."""
 
 
+class RegistryValueType(IntEnum):
+    NONE = regf.REG_NONE
+    SZ = regf.REG_SZ
+    EXPAND_SZ = regf.REG_EXPAND_SZ
+    BINARY = regf.REG_BINARY
+    DWORD = regf.REG_DWORD
+    DWORD_BIG_ENDIAN = regf.REG_DWORD_BIG_ENDIAN
+    MULTI_SZ = regf.REG_MULTI_SZ
+    FULL_RESOURCE_DESCRIPTOR = regf.REG_FULL_RESOURCE_DESCRIPTOR
+    RESOURCE_REQUIREMENTS_LIST = regf.REG_RESOURCE_REQUIREMENTS_LIST
+    QWORD = regf.REG_QWORD
+
+
 class RegistryHive:
     """Base class for registry hives."""
 
@@ -405,8 +419,8 @@ class VirtualValue(RegistryValue):
         return self._value
 
     @property
-    def type(self) -> int:
-        return None
+    def type(self) -> RegistryValueType:
+        return RegistryValueType.NONE
 
 
 class HiveCollection(RegistryHive):
@@ -683,8 +697,8 @@ class RegfValue(RegistryValue):
         return self.kv.value
 
     @property
-    def type(self) -> int:
-        return self.kv.type
+    def type(self) -> RegistryValueType:
+        return RegistryValueType(self.kv.type)
 
 
 class RegFlex:
@@ -750,17 +764,22 @@ class RegFlexKey(VirtualKey):
 
 class RegFlexValue(VirtualValue):
     def __init__(self, hive: RegistryHive, name: str, value: ValueType):
-        self._parsed_value = None
         super().__init__(hive, name, value)
 
+    @cached_property
+    def _parse(self) -> tuple[RegistryValueType, ValueType]:
+        return parse_flex_value(self._value)
+
     @property
     def value(self) -> ValueType:
-        if not self._parsed_value:
-            self._parsed_value = parse_flex_value(self._value)
-        return self._parsed_value
+        return self._parse[1]
+
+    @property
+    def type(self) -> RegistryValueType:
+        return self._parse[0]
 
 
-def parse_flex_value(value: str) -> ValueType:
+def parse_flex_value(value: str) -> tuple[RegistryValueType, ValueType]:
     """Parse values from text registry exports.
 
     Args:
@@ -770,31 +789,31 @@ def parse_flex_value(value: str) -> ValueType:
         NotImplementedError: If ``value`` is not of a supported type for parsing.
     """
     if value.startswith('"'):
-        return value.strip('"')
+        return RegistryValueType.SZ, value.strip('"')
 
     vtype, _, value = value.partition(":")
     if vtype == "dword":
-        return struct.unpack(">i", bytes.fromhex(value))[0]
+        return RegistryValueType.DWORD, int.from_bytes(bytes.fromhex(value), "big", signed=True)
     elif "hex" in vtype:
         value = bytes.fromhex(value.replace(",", ""))
         if vtype == "hex":
-            return value
+            return RegistryValueType.BINARY, value
 
         # hex(T)
         # These values match regf type values
         vtype = int(vtype[4:5], 16)
         if vtype == regf.REG_NONE:
-            return value if value else None
+            decoded = value if value else None
         elif vtype == regf.REG_SZ:
-            return regf.try_decode_sz(value)
+            decoded = regf.try_decode_sz(value)
         elif vtype == regf.REG_EXPAND_SZ:
-            return regf.try_decode_sz(value)
+            decoded = regf.try_decode_sz(value)
         elif vtype == regf.REG_BINARY:
-            return value
+            decoded = value
         elif vtype == regf.REG_DWORD:
-            return struct.unpack("<I", value)[0]
+            decoded = int.from_bytes(value, "little", signed=False)
         elif vtype == regf.REG_DWORD_BIG_ENDIAN:
-            return struct.unpack(">I", value)[0]
+            decoded = int.from_bytes(value, "big", signed=False)
         elif vtype == regf.REG_MULTI_SZ:
             d = BytesIO(value)
 
@@ -806,11 +825,12 @@ def parse_flex_value(value: str) -> ValueType:
 
                 r.append(s)
 
-            return r
+            decoded = r
         elif vtype == regf.REG_QWORD:
-            return struct.unpack(">Q", value)[0]
+            decoded = int.from_bytes(value, "big", signed=False)
         else:
             raise NotImplementedError(f"Registry flex value type {vtype}")
+        return RegistryValueType(vtype), decoded
 
 
 def has_glob_magic(pattern: str) -> bool:

dissect_target-3.20.dev29/dissect/target/plugins/apps/other/env.py

@@ -0,0 +1,56 @@
+from typing import Iterator
+
+from dissect.target.helpers.configutil import Env
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, arg, export
+
+EnvironmentFileRecord = TargetRecordDescriptor(
+    "application/other/file/environment",
+    [
+        ("datetime", "ts_mtime"),
+        ("string", "key"),
+        ("string", "value"),
+        ("string", "comment"),
+        ("path", "path"),
+    ],
+)
+
+
+class EnvironmentFilePlugin(Plugin):
+    """Environment file plugin."""
+
+    def check_compatible(self) -> None:
+        # `--env-path` is provided at runtime
+        pass
+
+    @export(record=EnvironmentFileRecord)
+    @arg("--env-path", help="path to scan environment files in")
+    @arg("--extension", help="extension of files to scan", default="env")
+    def envfile(self, env_path: str, extension: str = "env") -> Iterator[EnvironmentFileRecord]:
+        """Yield environment variables found in ``.env`` files at the provided path."""
+
+        if not env_path:
+            self.target.log.error("No ``--path`` provided!")
+
+        if not (path := self.target.fs.path(env_path)).exists():
+            self.target.log.error("Provided path %s does not exist!", path)
+
+        for file in path.glob("**/*." + extension):
+            if not file.is_file():
+                continue
+
+            mtime = file.lstat().st_mtime
+
+            with file.open("r") as fh:
+                parser = Env(comments=True)
+                parser.read_file(fh)
+
+                for key, (value, comment) in parser.parsed_data.items():
+                    yield EnvironmentFileRecord(
+                        ts_mtime=mtime,
+                        key=key,
+                        value=value,
+                        comment=comment,
+                        path=file,
+                        _target=self.target,
+                    )

{dissect_target-3.20.dev27 → dissect_target-3.20.dev29/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev27
+Version: 3.20.dev29
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.dev27 → dissect_target-3.20.dev29}/dissect.target.egg-info/SOURCES.txt

@@ -139,6 +139,7 @@ dissect/target/plugins/apps/browser/firefox.py
 dissect/target/plugins/apps/browser/iexplore.py
 dissect/target/plugins/apps/container/__init__.py
 dissect/target/plugins/apps/container/docker.py
+dissect/target/plugins/apps/other/env.py
 dissect/target/plugins/apps/remoteaccess/__init__.py
 dissect/target/plugins/apps/remoteaccess/anydesk.py
 dissect/target/plugins/apps/remoteaccess/remoteaccess.py
@@ -470,6 +471,8 @@ tests/plugins/apps/browser/test_firefox.py
 tests/plugins/apps/browser/test_iexplore.py
 tests/plugins/apps/container/__init__.py
 tests/plugins/apps/container/test_docker.py
+tests/plugins/apps/other/__init__.py
+tests/plugins/apps/other/test_envfile.py
 tests/plugins/apps/remoteaccess/__init__.py
 tests/plugins/apps/remoteaccess/test_anydesk.py
 tests/plugins/apps/remoteaccess/test_teamviewer.py

{dissect_target-3.20.dev27 → dissect_target-3.20.dev29}/tests/helpers/test_configutil.py

@@ -13,6 +13,7 @@ from dissect.target.helpers.configutil import (
     ConfigurationParser,
     CSVish,
     Default,
+    Env,
     Indentation,
     Json,
     ScopeManager,
@@ -317,3 +318,47 @@ def test_parse(target_linux: Target, fs_linux: VirtualFilesystem, tmp_path: Path
         parse(target_linux.fs.path("/path/to"))
 
     parse(target_linux.fs.path("/path/to/file"))
+
+
+@pytest.mark.parametrize(
+    "input,expected_output",
+    [
+        ("", {}),
+        ("foo=bar\n", {"foo": "bar"}),
+        ("foo = bar \n", {"foo": "bar"}),
+        ('foo = "bar"\n', {"foo": "bar"}),
+        ("foo=bar\nempty=\nhello=world\n", {"foo": "bar", "empty": "", "hello": "world"}),
+        # multiple delimiters
+        ("foo=option=foo,value=bar", {"foo": "option=foo,value=bar"}),
+        # types
+        ("foo=123", {"foo": 123}),
+        ("foo=1", {"foo": True}),
+        ("foo=0", {"foo": False}),
+        ("foo='1'", {"foo": True}),
+        ("foo=true", {"foo": True}),
+        ('foo="False"\nbar="true"\n', {"bar": True, "foo": False}),
+        # comments
+        ("foo=bar#\n", {"foo": "bar#"}),
+        ('foo="bar#"\n', {"foo": "bar#"}),
+        ("foo='bar#'\n", {"foo": "bar#"}),
+        ("foo=bar # comment\n", {"foo": "bar"}),
+        ("foo='bar' # comment\n", {"foo": "bar"}),
+        ("foo='bar #' # comment\n", {"foo": "bar #"}),
+        ("foo=bar# not a comment\n", {"foo": "bar# not a comment"}),
+        ("foo='bar # not a comment'\n", {"foo": "bar # not a comment"}),
+        (Path(absolute_path("_data/helpers/configutil/env")), {"foo": "'bar"}),
+        # whitespaces inside quotes
+        ("foo='bar '\n", {"foo": "bar "}),
+        # quotes inside values
+        ('foo=ba"r\n', {"foo": 'ba"r'}),
+    ],
+)
+def test_env_parser(input: str | Path, expected_output: dict) -> None:
+    parser = Env(comments=False)
+
+    if isinstance(input, str):
+        parser.parse_file(StringIO(input))
+    else:
+        parser.parse_file(input.open("r"))
+
+    assert parser.parsed_data == expected_output

{dissect_target-3.20.dev27 → dissect_target-3.20.dev29}/tests/helpers/test_regutil.py

@@ -8,6 +8,7 @@ from dissect.target.helpers.regutil import (
     RegFlex,
     RegistryHive,
     RegistryKeyNotFoundError,
+    RegistryValueType,
     VirtualHive,
     VirtualKey,
     glob_ext,
@@ -38,20 +39,49 @@ def test_regflex() -> None:
     key = hive.key("Test Values")
     assert len(key.values()) == 15
     assert key.value("String").value == "a"
+
+    assert key.value("String").type == RegistryValueType.SZ
     assert key.value("Long String").value == "a" * 1218
+    assert key.value("Long String").type == RegistryValueType.SZ
+
     assert key.value("Binary").value == b"\x00" * 8
+    assert key.value("Binary").type == RegistryValueType.BINARY
+
     assert key.value("Long Binary").value == b"\x00" * 240
+    assert key.value("Long Binary").type == RegistryValueType.BINARY
+
     assert key.value("Dword").value == 1
+    assert key.value("Dword").type == RegistryValueType.DWORD
+
     assert key.value("None").value == b"\x00\x01\x02\x04"
+    assert key.value("None").type == RegistryValueType.NONE
+
     assert key.value("Hex String").value == "abcd"
+    assert key.value("Hex String").type == RegistryValueType.SZ
+
     assert key.value("Expandable String").value == "a"
+    assert key.value("Expandable String").type == RegistryValueType.EXPAND_SZ
+
     assert key.value("Long Expandable String").value == "a" * 2584
+    assert key.value("Long Expandable String").type == RegistryValueType.EXPAND_SZ
+
     assert key.value("Hex Binary").value == b"\x00" * 8
+    assert key.value("Hex Binary").type == RegistryValueType.BINARY
+
     assert key.value("Hex Dword LE").value == 1
+    assert key.value("Hex Dword LE").type == RegistryValueType.DWORD
+
     assert key.value("Hex Dword BE").value == 1
+    assert key.value("Hex Dword BE").type == RegistryValueType.DWORD_BIG_ENDIAN
+
     assert key.value("Multi String").value == ["a", "b", "c", "d"]
+    assert key.value("Multi String").type == RegistryValueType.MULTI_SZ
+
     assert key.value("Long Multi String").value == ["a" * 1024, "b" * 1024, "c" * 1024, "d" * 1024]
+    assert key.value("Long Multi String").type == RegistryValueType.MULTI_SZ
+
     assert key.value("Qword").value == 1
+    assert key.value("Qword").type == RegistryValueType.QWORD
 
 
 @pytest.mark.parametrize(

dissect_target-3.20.dev29/tests/plugins/apps/other/test_envfile.py

@@ -0,0 +1,40 @@
+from datetime import datetime
+
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.apps.other.env import EnvironmentFilePlugin
+from dissect.target.target import Target
+from tests._utils import absolute_path
+
+
+def test_envfile(target_unix: Target, fs_unix: VirtualFilesystem) -> None:
+    target_unix.add_plugin(EnvironmentFilePlugin)
+    fs_unix.map_file("/root/foo.env", absolute_path("_data/plugins/apps/other/env/test.env"))
+    fs_unix.map_file("/root/foo/bar/test.env", absolute_path("_data/plugins/apps/other/env/test.env"))
+
+    records = list(target_unix.envfile(env_path="/root"))
+
+    assert len(records) == 4 * 2
+
+    assert isinstance(records[0].ts_mtime, datetime)
+    assert records[0].key == "DEBUG"
+    assert records[0].value == "True"
+    assert records[0].comment is None
+    assert records[0].path == "/root/foo.env"
+
+    assert isinstance(records[1].ts_mtime, datetime)
+    assert records[1].key == "OPTIONAL"
+    assert records[1].value == ""
+    assert records[1].comment == "comment"
+    assert records[1].path == "/root/foo.env"
+
+    assert isinstance(records[2].ts_mtime, datetime)
+    assert records[2].key == "FOO"
+    assert records[2].value == "bar"
+    assert records[2].comment == "this is a comment"
+    assert records[2].path == "/root/foo.env"
+
+    assert isinstance(records[3].ts_mtime, datetime)
+    assert records[3].key == "HELLO"
+    assert records[3].value == "world"
+    assert records[3].comment is None
+    assert records[3].path == "/root/foo.env"