dissect.target 3.23.dev11__tar.gz → 3.23.dev14__tar.gz

{dissect_target-3.23.dev11 → dissect_target-3.23.dev14}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev11
+Version: 3.23.dev14
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev11 → dissect_target-3.23.dev14}/dissect/target/loaders/ab.py

@@ -157,16 +157,31 @@ class AndroidBackup:
         offset = 0
         iv_len = blob[offset]
         offset += 1
-        iv = blob[offset : offset + iv_len]
 
+        iv = blob[offset : offset + iv_len]
         offset += iv_len
+
+        if offset >= len(blob):
+            raise ValueError("Invalid password: bogus IV length")
+
         mk_len = blob[offset]
         offset += 1
-        mk = blob[offset : offset + mk_len]
 
+        if offset >= len(blob):
+            raise ValueError("Invalid password: bogus master key length")
+
+        mk = blob[offset : offset + mk_len]
         offset += mk_len
+
+        if offset >= len(blob):
+            raise ValueError("Invalid password: bogus IV length")
+
         checksum_len = blob[offset]
         offset += 1
+
+        if offset >= len(blob):
+            raise ValueError("Invalid password: bogus checksum length")
+
         checksum = blob[offset : offset + checksum_len]
 
         ck_mk = _encode_bytes(mk) if self.version >= 2 else mk

{dissect_target-3.23.dev11 → dissect_target-3.23.dev14}/dissect/target/loaders/tar.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import logging
 import re
 import tarfile as tf
+from io import BytesIO
 from typing import TYPE_CHECKING
 
 from dissect.target import filesystem, target
@@ -25,10 +26,14 @@ TAR_EXT_COMP = (
     ".tar.xz",
     ".tar.bz",
     ".tar.bz2",
+    ".tar.lzma",
+    ".tar.lz",
     ".tgz",
     ".txz",
     ".tbz",
     ".tbz2",
+    ".tlz",
+    ".tlzma",
 )
 TAR_EXT = (".tar",)
 
@@ -39,6 +44,16 @@ TAR_MAGIC_COMP = (
     b"\x42\x5a\x68",
     # xz
     b"\xfd\x37\x7a\x58\x5a\x00",
+    # lzma
+    b"\x5d\x00\x00\x01\x00",
+    b"\x5d\x00\x00\x10\x00",
+    b"\x5d\x00\x00\x08\x00",
+    b"\x5d\x00\x00\x10\x00",
+    b"\x5d\x00\x00\x20\x00",
+    b"\x5d\x00\x00\x40\x00",
+    b"\x5d\x00\x00\x80\x00",
+    b"\x5d\x00\x00\x00\x01",
+    b"\x5d\x00\x00\x00\x02",
 )
 TAR_MAGIC = (tf.GNU_MAGIC, tf.POSIX_MAGIC)
 
@@ -196,11 +211,22 @@ def is_tar_magic(path: Path, magics: Iterable[bytes]) -> bool:
         return False
 
     with path.open("rb") as fh:
-        headers = [fh.read(6)]
-        fh.seek(257)
-        headers.append(fh.read(8))
+        # The minimum file size of an uncompressed tar is 512 bytes, but a compressed tar file could be smaller.
+        fh.seek(0)
+        buf = fh.read(tf.BLOCKSIZE)
+        headers = [buf[0:6]]
+        if len(buf) >= 265:
+            headers.append(buf[257 : 257 + 8])
+
         for header in headers:
             if header.startswith(magics):
+                # We could be dealing with a compressed file that is not actually a tar.
+                # To weed out a false positive we try to decompress and read ustar from
+                # the first 512 bytes (or less) of the file.
+                try:
+                    tf.open(mode="r:*", fileobj=BytesIO(buf))  # noqa: SIM115
+                except (tf.ReadError, tf.CompressionError, ValueError, EOFError):
+                    continue
                 return True
     return False
 

{dissect_target-3.23.dev11 → dissect_target-3.23.dev14}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev11
+Version: 3.23.dev14
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev11 → dissect_target-3.23.dev14}/dissect.target.egg-info/SOURCES.txt

@@ -474,6 +474,7 @@ tests/filesystems/test_ntfs.py
 tests/filesystems/test_overlay.py
 tests/filesystems/test_qnxfs.py
 tests/filesystems/test_smb.py
+tests/filesystems/test_squashfs.py
 tests/filesystems/test_tar.py
 tests/filesystems/test_vmtar.py
 tests/filesystems/test_xfs.py

{dissect_target-3.23.dev11 → dissect_target-3.23.dev14}/tests/conftest.py

@@ -580,7 +580,7 @@ def target_unix_factory(tmp_path: pathlib.Path) -> TargetUnixFactory:
     return TargetUnixFactory(tmp_path)
 
 
-@pytest.fixture
+@pytest.fixture(autouse=True)
 def guarded_keychain() -> Iterator[None]:
     """This fixture clears the keychain from any previously added values."""
     keychain.KEYCHAIN.clear()

dissect_target-3.23.dev14/tests/filesystems/test_squashfs.py

@@ -0,0 +1,48 @@
+from __future__ import annotations
+
+import platform
+
+import pytest
+
+from dissect.target.filesystems.squashfs import SquashFSFilesystem
+from tests._utils import absolute_path
+
+
+@pytest.mark.parametrize("type", ["gzip", "gzip-opts", "lz4", "lzma", "lzo", "xz", "zstd"])
+def test_filesystem_squashfs(type: str) -> None:
+    """Test if we detect and correctly iterate SquashFS filesystems."""
+
+    if type == "lzma" and platform.system() == "Windows":
+        pytest.skip(reason="SquashFS LZMA misbehaves on Windows")
+
+    sqfs_bin = absolute_path(f"_data/filesystems/squashfs/{type}.sqfs")
+
+    with sqfs_bin.open("rb") as fh:
+        assert SquashFSFilesystem.detect(fh)
+
+        fs = SquashFSFilesystem(fh)
+
+        assert [f.name for f in fs.path("/").iterdir()] == [
+            "dir",
+            "file-with-xattr",
+            "large-file",
+            "small-file",
+            "symlink-1",
+            "symlink-2",
+            "symlink-with-xattr",
+        ]
+
+        assert fs.path("/dir").is_dir()
+        assert fs.path("/symlink-2").is_symlink()
+        assert fs.path("/dir/file_99").is_file()
+        assert fs.path("/small-file").read_bytes() == b"contents\n"
+        assert fs.path("/symlink-2").resolve().as_posix() == "/dir/file_69"
+
+        stat = fs.path("/large-file").lstat()
+        assert stat.st_mode == 0o100644
+        assert stat.st_ino == 103
+        assert stat.st_nlink == 1
+        assert stat.st_uid == 1000
+        assert stat.st_gid == 1000
+        assert stat.st_size == 4177920
+        assert stat.st_mtime == 1670266447.0

{dissect_target-3.23.dev11 → dissect_target-3.23.dev14}/tests/helpers/test_keychain.py

@@ -6,7 +6,7 @@ from dissect.target.helpers import keychain
 from tests._utils import absolute_path
 
 
-def test_keychain_register_keychain_file(guarded_keychain: None) -> None:
+def test_keychain_register_keychain_file() -> None:
     keychain_file = Path(absolute_path("_data/helpers/keychain/keychain.csv"))
 
     keychain.register_keychain_file(keychain_file)
@@ -16,7 +16,7 @@ def test_keychain_register_keychain_file(guarded_keychain: None) -> None:
     assert len(keychain.get_keys_for_provider("bitlocker")) == 2
 
 
-def test_keychain_register_wildcard_value(guarded_keychain: None) -> None:
+def test_keychain_register_wildcard_value() -> None:
     keychain.register_wildcard_value("test-value")
 
     # Number of keys registered is equal number of supported key types, minus one for an invalid raw key

{dissect_target-3.23.dev11 → dissect_target-3.23.dev14}/tests/loaders/test_ab.py

@@ -39,7 +39,7 @@ def test_ab_loader(target_bare: Target) -> None:
 
 
 def test_ab_unwrapper(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-    ab_path = Path(absolute_path("_data/loaders/ab/test.ab"))
+    ab_path = absolute_path("_data/loaders/ab/test.ab")
 
     with monkeypatch.context() as m:
         m.setattr("sys.argv", ["python", str(ab_path), "-p", "password", "-o", str(tmp_path)])

{dissect_target-3.23.dev11 → dissect_target-3.23.dev14}/tests/loaders/test_tar.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import platform
 import tarfile
 from typing import TYPE_CHECKING
 
@@ -132,30 +133,51 @@ def test_tar_anonymous_filesystems(target_default: Target) -> None:
     [
         # regular tar file
         (True, "file.tar", ""),
-        (True, "file", "00" * 257 + "7573746172202000"),
         # gzip tar file
         (True, "file.tar.gz", ""),
         (True, "file.tgz", ""),
-        (True, "file", "1f8b0800000000000000"),
         # bzip2 tar file
         (True, "file.tar.bz2", ""),
         (True, "file.tar.bz", ""),
         (True, "file.tbz", ""),
         (True, "file.tbz2", ""),
-        (True, "file", "425a6839314159265359"),
         # xz tar file
         (True, "file.tar.xz", ""),
         (True, "file.txz", ""),
-        (True, "file", "fd377a585a000004e6d6"),
         # some things it should not detect
         (False, "file", "00010203"),
         (False, "file.zip", "504b0304"),
     ],
 )
-def test_tar_detect(should_detect: bool, filename: str, buffer: str, tmp_path: pathlib.Path) -> None:
+def test_tar_detect_extension(should_detect: bool, filename: str, buffer: str, tmp_path: pathlib.Path) -> None:
     """Test if we detect the given buffer as a (compressed) tar file or not."""
     tmp_tar = tmp_path.joinpath(filename)
     tmp_tar.touch()
     with tmp_tar.open("wb") as fh:
         fh.write(bytes.fromhex(buffer))
     assert TarLoader.detect(tmp_tar) == should_detect
+
+
+@pytest.mark.parametrize(
+    "file",
+    [
+        "small.tar",
+        "small.tar.bz2",
+        "small.tar.gz",
+        "small.tar.lz",
+        "small.tar.xz",
+    ],
+)
+def test_tar_detect_buffer(file: str, tmp_path: pathlib.Path) -> None:
+    """Test if we detect the given files as a (compressed) tar file or not."""
+
+    if file == "small.tar.lz" and (platform.python_implementation() == "PyPy" or platform.system() == "Windows"):
+        pytest.skip(reason="LZMA is flaky on PyPy and/or Windows")
+
+    small_file = absolute_path(f"_data/loaders/tar/detect/{file}")
+
+    # We rename the file to prevent detection based on file suffix.
+    tmp_tar = tmp_path.joinpath(file.replace(".", "-"))
+    tmp_tar.write_bytes(small_file.read_bytes())
+
+    assert TarLoader.detect(tmp_tar)

{dissect_target-3.23.dev11 → dissect_target-3.23.dev14}/tests/plugins/apps/browser/test_chrome.py

@@ -305,7 +305,6 @@ def target_win_11_users_dpapi(
 def test_windows_chrome_passwords_dpapi(
     target_win_users_dpapi: Target,
     fs_win: VirtualFilesystem,
-    guarded_keychain: None,
     keychain_value: str,
     expected_password: str | None,
     expected_notes: str | None,
@@ -342,9 +341,7 @@ def test_windows_chrome_passwords_dpapi(
     assert records[0].decrypted_notes == expected_notes
 
 
-def test_windows_chrome_cookies_dpapi(
-    target_win_users_dpapi: Target, fs_win: VirtualFilesystem, guarded_keychain: None
-) -> None:
+def test_windows_chrome_cookies_dpapi(target_win_users_dpapi: Target, fs_win: VirtualFilesystem) -> None:
     fs_win.map_dir(
         "Users/user/AppData/Local/Google/Chrome/User Data",
         absolute_path("_data/plugins/apps/browser/chrome/dpapi/windows_10/User_Data"),
@@ -423,9 +420,7 @@ def test_chrome_windows_snapshots(target_win_users: Target, fs_win: VirtualFiles
         assert len(base_path_records) == len(snapshot_records)
 
 
-def test_chrome_windows_11_decryption(
-    target_win_11_users_dpapi: Target, fs_win: VirtualFilesystem, guarded_keychain: None
-) -> None:
+def test_chrome_windows_11_decryption(target_win_11_users_dpapi: Target, fs_win: VirtualFilesystem) -> None:
     """Test if we can decrypt Windows 11 Google Chrome version 127/130 and newer passwords and cookies.
 
     Elevation Service usage by Chromium-based browsers (Google Chrome, Microsoft Edge) depend on several environment

{dissect_target-3.23.dev11 → dissect_target-3.23.dev14}/tests/plugins/os/windows/credential/test_credhist.py

@@ -57,7 +57,6 @@ def test_credhist_partial(target_win_users: Target, fs_win: VirtualFilesystem) -
     )
     target_win_users.add_plugin(CredHistPlugin)
 
-    keychain.KEYCHAIN.clear()
     keychain.register_key(
         key_type=keychain.KeyType.PASSPHRASE,
         value="password3",

{dissect_target-3.23.dev11 → dissect_target-3.23.dev14}/tests/plugins/os/windows/dpapi/keyprovider/test_keychain.py

@@ -11,8 +11,6 @@ if TYPE_CHECKING:
 
 def test_dpapi_keyprovider_keychain(target_win: Target) -> None:
     """test if we yield provided keychain items correctly."""
-
-    keychain.KEYCHAIN.clear()
     keychain.register_key(
         key_type=keychain.KeyType.PASSPHRASE,
         value="password1",

{dissect_target-3.23.dev11 → dissect_target-3.23.dev14}/tests/plugins/os/windows/dpapi/test_dpapi.py

@@ -157,7 +157,6 @@ def test_dpapi_decrypt_blob_win_10(
 
     if user_type == "user":
         # test decrypting dpapi user blob
-        keychain.KEYCHAIN.clear()
         keychain.register_key(
             key_type=keychain.KeyType.PASSPHRASE,
             value="password",