dissect.target 3.25.dev19__tar.gz → 3.25.dev20__tar.gz

{dissect_target-3.25.dev19 → dissect_target-3.25.dev20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev19
+Version: 3.25.dev20
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_target-3.25.dev19 → dissect_target-3.25.dev20}/dissect/target/plugins/os/windows/ual.py

@@ -59,7 +59,7 @@ VirtualMachineRecord = TargetRecordDescriptor(
 )
 
 DomainSeenRecord = TargetRecordDescriptor(
-    "filesystem/windows/ual/virtual_machines",
+    "filesystem/windows/ual/domain",
     [
         ("datetime", "last_seen_date"),
         ("net.ipaddress", "address"),

{dissect_target-3.25.dev19 → dissect_target-3.25.dev20}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev19
+Version: 3.25.dev20
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_target-3.25.dev19 → dissect_target-3.25.dev20}/tests/test_plugin.py

@@ -1750,29 +1750,40 @@ def test_exported_plugin_format(descriptor: FunctionDescriptor) -> None:
             )
 
 
-def test_plugin_record_field_consistency() -> None:
-    """Test if exported plugin functions yielding records do not have conflicting field names and types.
+def test_plugin_record_field_and_name_consistency() -> None:
+    """Test that ensures that record fields with the same name across different plugins translate to the
+    same normalized type, and that no two records share the same name.
 
-    For example, take the following TargetRecordDescriptors for plugin X, Y and Z::
+    Consider the following TargetRecordDescriptors for plugins X, Y, Z, A and B::
 
-        RecordX = TargetRecordDescriptor("record/x", [("varint", "my_field")])
-        RecordY = TargetRecordDescriptor("record/y", [("path", "my_field")])
-        RecordZ = TargetRecordDescriptor("record/y", [("string", "my_field")])
+        # Field consistency example
+        RecordX = TargetRecordDescriptor("record/x", [("varint", "shared_field")])
+        RecordY = TargetRecordDescriptor("record/y", [("path", "shared_field")])
+        RecordZ = TargetRecordDescriptor("record/z", [("string", "shared_field")])
 
-    The ``RecordX`` descriptor will fail in this test, since the field ``my_field`` cannot be of type ``varint``
-    while also being used as ``string`` (and ``path``). The ``RecordY`` and ``RecordZ`` descriptors do not conflict,
-    since the types ``path`` and ``string`` translate to the same ``wildcard`` type.
+        # Record name consistency example
+        RecordA = TargetRecordDescriptor("record/a", [("string", "field1")])
+        RecordB = TargetRecordDescriptor("record/a", [("varint", "field2")])
 
-    Uses ``FIELD_TYPES_MAP`` which is loosely based on flow.record and ElasticSearch field types.
+    In the first example, ``RecordX`` will fail the test, as the field ``shared_field`` cannot be ``varint`` in
+    one record also being used as ``string``/``path`` in others. ``RecordY`` and ``RecordZ`` do
+    not conflict, as both translate to the same ``wildcard`` type.
+
+    In the second example, ``RecordA`` and ``RecordB`` will fail the test because they both define the name
+    ``record/a``. Duplicate record names may cause collisions in export formats or downstream processing.
+
+    Field type normalization is based on ``FIELD_TYPES_MAP``, loosely aligned with flow.record and
+    ElasticSearch type mappings.
 
     References:
         - https://elastic.co/guide/en/elasticsearch/reference/current/mapping-types.html
         - https://github.com/fox-it/flow.record/tree/main/flow/record/fieldtypes
         - https://github.com/JSCU-NL/dissect-elastic
     """
-
+    seen_records: set[RecordDescriptor] = set()
     seen_field_names: set[str] = set()
     seen_field_types: dict[str, tuple[str | None, RecordDescriptor]] = {}
+    seen_record_names: set[str] = set()
     inconsistencies: set[str] = set()
 
     FIELD_TYPES_MAP = {
@@ -1804,38 +1815,50 @@ def test_plugin_record_field_consistency() -> None:
 
     for descriptor in find_functions("*", Target(), compatibility=False, show_hidden=True)[0]:
         # Test if plugin function record fields make sense and do not conflict with other records.
-        if descriptor.output == "record" and hasattr(descriptor, "record"):
-            # Functions can yield a single record or a list of records.
-            records = descriptor.record if isinstance(descriptor.record, list) else [descriptor.record]
+        if descriptor.output != "record" or not hasattr(descriptor, "record"):
+            continue
+
+        # Functions can yield a single record or a list of records.
+        records = descriptor.record if isinstance(descriptor.record, list) else [descriptor.record]
+
+        for record in records:
+            assert isinstance(record, RecordDescriptor), (
+                f"{record!r} of function {descriptor!r} is not of type RecordDescriptor"
+            )
+            if record.name != "empty":
+                assert record.fields, f"{record!r} has no fields"
 
-            for record in records:
-                assert isinstance(record, RecordDescriptor), (
-                    f"{record!r} of function {descriptor!r} is not of type RecordDescriptor"
+            if record in seen_records:
+                continue
+
+            seen_records.add(record)
+            # Detect duplicate record names
+            if record.name in seen_record_names:
+                inconsistencies.add(f"<{record.name}> has duplicates")
+            else:
+                seen_record_names.add(record.name)
+
+            for name, field in record.fields.items():
+                # Make sure field names have the same type when translated. This check does not save multiple field
+                # name and typenames, this is a bare-minumum check only.
+
+                # We only care about the field type, not if it is a list of that type.
+                field_typename = field.typename.replace("[]", "")
+
+                assert field_typename in FIELD_TYPES_MAP, (
+                    f"Field type {field_typename} is not mapped in FIELD_TYPES_MAP, please add it manually."
                 )
-                if record.name != "empty":
-                    assert record.fields, f"{record!r} has no fields"
-
-                for name, field in record.fields.items():
-                    # Make sure field names have the same type when translated. This check does not save multiple field
-                    # name and typenames, this is a bare-minumum check only.
-
-                    # We only care about the field type, not if it is a list of that type.
-                    field_typename = field.typename.replace("[]", "")
-
-                    assert field_typename in FIELD_TYPES_MAP, (
-                        f"Field type {field_typename} is not mapped in FIELD_TYPES_MAP, please add it manually."
-                    )
-
-                    if name in seen_field_names:
-                        seen_typename, seen_record = seen_field_types[name]
-                        if FIELD_TYPES_MAP[seen_typename] != FIELD_TYPES_MAP[field_typename]:
-                            inconsistencies.add(
-                                f"<{record.name} ({field.typename!r}, '{name}')> is duplicate mismatch of <{seen_record.name} ({seen_typename!r}, '{name}')>"  # noqa: E501
-                            )
-
-                    else:
-                        seen_field_names.add(name)
-                        seen_field_types[name] = (field_typename, record)
+
+                if name in seen_field_names:
+                    seen_typename, seen_record = seen_field_types[name]
+                    if FIELD_TYPES_MAP[seen_typename] != FIELD_TYPES_MAP[field_typename]:
+                        inconsistencies.add(
+                            f"<{record.name} ({field.typename!r}, '{name}')> is duplicate mismatch of <{seen_record.name} ({seen_typename!r}, '{name}')>"  # noqa: E501
+                        )
+
+                else:
+                    seen_field_names.add(name)
+                    seen_field_types[name] = (field_typename, record)
 
     if inconsistencies:
         pytest.fail(