flow.record 3.16.dev6__tar.gz → 3.16.dev8__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (82) hide show
  1. {flow_record-3.16.dev6/flow.record.egg-info → flow_record-3.16.dev8}/PKG-INFO +1 -1
  2. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/fieldtypes/__init__.py +2 -1
  3. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/jsonpacker.py +6 -1
  4. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/version.py +2 -2
  5. {flow_record-3.16.dev6 → flow_record-3.16.dev8/flow.record.egg-info}/PKG-INFO +1 -1
  6. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_fieldtypes.py +9 -2
  7. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_json_packer.py +21 -0
  8. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/COPYRIGHT +0 -0
  9. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/LICENSE +0 -0
  10. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/MANIFEST.in +0 -0
  11. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/README.md +0 -0
  12. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/examples/filesystem.py +0 -0
  13. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/examples/passivedns.py +0 -0
  14. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/examples/records.json +0 -0
  15. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/examples/tcpconn.py +0 -0
  16. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/__init__.py +0 -0
  17. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/__init__.py +0 -0
  18. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/archive.py +0 -0
  19. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/avro.py +0 -0
  20. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/broker.py +0 -0
  21. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/csvfile.py +0 -0
  22. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/duckdb.py +0 -0
  23. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/elastic.py +0 -0
  24. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/jsonfile.py +0 -0
  25. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/line.py +0 -0
  26. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/mongo.py +0 -0
  27. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/split.py +0 -0
  28. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/splunk.py +0 -0
  29. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/sqlite.py +0 -0
  30. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/stream.py +0 -0
  31. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/text.py +0 -0
  32. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/adapter/xlsx.py +0 -0
  33. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/base.py +0 -0
  34. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/exceptions.py +0 -0
  35. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/fieldtypes/credential.py +0 -0
  36. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/fieldtypes/net/__init__.py +0 -0
  37. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/fieldtypes/net/ip.py +0 -0
  38. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/fieldtypes/net/ipv4.py +0 -0
  39. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/fieldtypes/net/tcp.py +0 -0
  40. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/fieldtypes/net/udp.py +0 -0
  41. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/packer.py +0 -0
  42. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/selector.py +0 -0
  43. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/stream.py +0 -0
  44. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/tools/__init__.py +0 -0
  45. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/tools/geoip.py +0 -0
  46. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/tools/rdump.py +0 -0
  47. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/utils.py +0 -0
  48. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow/record/whitelist.py +0 -0
  49. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow.record.egg-info/SOURCES.txt +0 -0
  50. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow.record.egg-info/dependency_links.txt +0 -0
  51. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow.record.egg-info/entry_points.txt +0 -0
  52. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow.record.egg-info/requires.txt +0 -0
  53. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/flow.record.egg-info/top_level.txt +0 -0
  54. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/pyproject.toml +0 -0
  55. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/setup.cfg +0 -0
  56. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/__init__.py +0 -0
  57. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/_utils.py +0 -0
  58. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/docs/Makefile +0 -0
  59. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/docs/conf.py +0 -0
  60. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/docs/index.rst +0 -0
  61. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/selector_explain_example.py +0 -0
  62. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/standalone_test.py +0 -0
  63. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_avro.py +0 -0
  64. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_avro_adapter.py +0 -0
  65. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_compiled_selector.py +0 -0
  66. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_csv_adapter.py +0 -0
  67. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_deprecations.py +0 -0
  68. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_elastic_adapter.py +0 -0
  69. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_fieldtype_ip.py +0 -0
  70. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_json_record_adapter.py +0 -0
  71. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_multi_timestamp.py +0 -0
  72. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_packer.py +0 -0
  73. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_rdump.py +0 -0
  74. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_record.py +0 -0
  75. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_record_adapter.py +0 -0
  76. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_record_descriptor.py +0 -0
  77. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_regression.py +0 -0
  78. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_selector.py +0 -0
  79. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_splunk_adapter.py +0 -0
  80. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/test_sqlite_duckdb_adapter.py +0 -0
  81. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tests/utils_inspect.py +0 -0
  82. {flow_record-3.16.dev6 → flow_record-3.16.dev8}/tox.ini +0 -0
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.1
2
2
  Name: flow.record
3
- Version: 3.16.dev6
3
+ Version: 3.16.dev8
4
4
  Summary: A library for defining and creating structured data (called records) that can be streamed to disk or piped to other tools that use flow.record
5
5
  Author-email: Dissect Team <dissect@fox-it.com>
6
6
  License: Affero General Public License v3
@@ -767,7 +767,8 @@ class command(FieldType):
767
767
  # an '%' for an environment variable
768
768
  # r'\\' for a UNC path
769
769
  # the strip and check for ":" on the second line is for `<drive_letter>:`
770
- windows = value.startswith((r"\\", "%")) or value.lstrip("\"'")[1] == ":"
770
+ stripped_value = value.lstrip("\"'")
771
+ windows = value.startswith((r"\\", "%")) or (len(stripped_value) >= 2 and stripped_value[1] == ":")
771
772
 
772
773
  if windows:
773
774
  cls = windows_command
@@ -41,15 +41,20 @@ class JsonRecordPacker:
41
41
  if obj._desc.identifier not in self.descriptors:
42
42
  self.register(obj._desc, True)
43
43
  serial = obj._asdict()
44
+
44
45
  if self.pack_descriptors:
45
46
  serial["_type"] = "record"
46
47
  serial["_recorddescriptor"] = obj._desc.identifier
47
48
 
48
- # PYTHON2: Because "bytes" are also "str" we have to handle this here
49
49
  for field_type, field_name in obj._desc.get_field_tuples():
50
+ # PYTHON2: Because "bytes" are also "str" we have to handle this here
50
51
  if field_type == "bytes" and isinstance(serial[field_name], str):
51
52
  serial[field_name] = base64.b64encode(serial[field_name]).decode()
52
53
 
54
+ # Boolean field types should be cast to a bool instead of staying ints
55
+ elif field_type == "boolean" and isinstance(serial[field_name], int):
56
+ serial[field_name] = bool(serial[field_name])
57
+
53
58
  return serial
54
59
  if isinstance(obj, RecordDescriptor):
55
60
  serial = {
@@ -12,5 +12,5 @@ __version__: str
12
12
  __version_tuple__: VERSION_TUPLE
13
13
  version_tuple: VERSION_TUPLE
14
14
 
15
- __version__ = version = '3.16.dev6'
16
- __version_tuple__ = version_tuple = (3, 16, 'dev6')
15
+ __version__ = version = '3.16.dev8'
16
+ __version_tuple__ = version_tuple = (3, 16, 'dev8')
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.1
2
2
  Name: flow.record
3
- Version: 3.16.dev6
3
+ Version: 3.16.dev8
4
4
  Summary: A library for defining and creating structured data (called records) that can be streamed to disk or piped to other tools that use flow.record
5
5
  Author-email: Dissect Team <dissect@fox-it.com>
6
6
  License: Affero General Public License v3
@@ -1075,9 +1075,16 @@ def test_command_integration_none(tmp_path: pathlib.Path) -> None:
1075
1075
  # Test a quoted path
1076
1076
  (r"'c:\path to some exe' /d /a", r"c:\path to some exe", [r"/d /a"]),
1077
1077
  # Test a unquoted path
1078
- (r"'c:\Program Files\hello.exe'", r"c:\Program Files\hello.exe", []),
1078
+ (r"\Users\test\hello.exe", r"\Users\test\hello.exe", []),
1079
1079
  # Test an unquoted path with a path as argument
1080
- (r"'c:\Program Files\hello.exe' c:\startmepls.exe", r"c:\Program Files\hello.exe", [r"c:\startmepls.exe"]),
1080
+ (r"\Users\test\hello.exe c:\startmepls.exe", r"\Users\test\hello.exe", [r"c:\startmepls.exe"]),
1081
+ # Test a quoted UNC path
1082
+ (r"'\\192.168.1.2\Program Files\hello.exe'", r"\\192.168.1.2\Program Files\hello.exe", []),
1083
+ # Test an unquoted UNC path
1084
+ (r"\\192.168.1.2\Users\test\hello.exe /d /a", r"\\192.168.1.2\Users\test\hello.exe", [r"/d /a"]),
1085
+ # Test an empty command string
1086
+ (r"''", r"", []),
1087
+ # Test None
1081
1088
  (None, None, None),
1082
1089
  ],
1083
1090
  )
@@ -69,3 +69,24 @@ def test_record_descriptor_not_found():
69
69
  packer = JsonRecordPacker()
70
70
  with pytest.raises(RecordDescriptorNotFound, match="No RecordDescriptor found for: .*test/descriptor_not_found"):
71
71
  packer.unpack(data)
72
+
73
+
74
+ def test_record_pack_bool_regression() -> None:
75
+ TestRecord = RecordDescriptor(
76
+ "test/record_pack_bool",
77
+ [
78
+ ("varint", "some_varint"),
79
+ ("uint16", "some_uint"),
80
+ ("boolean", "some_boolean"),
81
+ ],
82
+ )
83
+
84
+ record = TestRecord(some_varint=1, some_uint=0, some_boolean=False)
85
+ packer = JsonRecordPacker()
86
+
87
+ # pack to json string and check if some_boolean is false instead of 0
88
+ data = packer.pack(record)
89
+ assert data.startswith('{"some_varint": 1, "some_uint": 0, "some_boolean": false, ')
90
+
91
+ # pack the json string back to a record and make sure it is the same as before
92
+ assert packer.unpack(data) == record
File without changes
File without changes