flow.record 3.22.dev2__py3-none-any.whl → 3.22.dev4__py3-none-any.whl

flow/record/base.py

@@ -893,6 +893,8 @@ def RecordAdapter(
                             "entering record text, rather than a record stream? This can be fixed by using "
                             "'rdump -w -' to write a record stream to stdout."
                         )
+                    if not peek_data:
+                        raise EOFError("Empty input stream")
                     raise RecordAdapterNotFound("Could not find adapter for file-like object")
 
             # Now that we found an adapter, we will fall back into the same code path as when a URL is given. As the url

flow/record/fieldtypes/__init__.py

@@ -752,41 +752,39 @@ class windows_path(pathlib.PureWindowsPath, path):
 
 
 class command(FieldType):
-    executable: path | None = None
-    args: list[str] | None = None
+    """The command fieldtype splits a command string into an ``executable`` and its arguments.
 
-    _path_type: type[path] = None
-    _posix: bool
+    Args:
+        value: the string that contains the command and arguments
+        path_type: When specified it forces the command to use a specific path type
 
-    def __new__(cls, value: str):
-        if cls is not command:
-            return super().__new__(cls)
+    Example:
 
-        if not isinstance(value, str):
-            raise TypeError(f"Expected a value of type 'str' not {type(value)}")
+    .. code-block:: text
+
+        'c:\\windows\\malware.exe /info'                      ->   windows_path('c:\\windows\\malware.exe) ['/info']
+        '/usr/bin/env bash'                                   ->   posix_path('/usr/bin/env') ['bash']
 
-        # pre checking for windows like paths
-        # This checks for windows like starts of a path:
-        #   an '%' for an environment variable
-        #   r'\\' for a UNC path
-        #   the strip and check for ":" on the second line is for `<drive_letter>:`
-        stripped_value = value.lstrip("\"'")
-        windows = value.startswith((r"\\", "%")) or (len(stripped_value) >= 2 and stripped_value[1] == ":")
+        # In this situation, the executable path needs to be quoted.
+        'c:\\user\\John Doe\\malware.exe /all /the /things'   ->   windows_path('c:\\user\\John')
+                                                                   ['Doe\\malware.exe /all /the /things']
+    """
 
-        cls = windows_command if windows else posix_command
-        return super().__new__(cls)
+    __executable: path
+    __args: tuple[str, ...]
 
-    def __init__(self, value: str | tuple[str, tuple[str]] | None):
-        if value is None:
-            return
+    __path_type: type[path]
 
-        if isinstance(value, str):
-            self.executable, self.args = self._split(value)
-            return
+    def __init__(self, value: str = "", *, path_type: type[path] | None = None):
+        if not isinstance(value, str):
+            raise TypeError(f"Expected a value of type 'str' not {type(value)}")
+
+        raw = value.strip()
 
-        executable, self.args = value
-        self.executable = self._path_type(executable)
-        self.args = list(self.args)
+        # Detect the kind of path from value if not specified
+        self.__path_type = path_type or type(path(raw.lstrip("\"'")))
+
+        self.executable, self.args = self._split(raw)
 
     def __repr__(self) -> str:
         return f"(executable={self.executable!r}, args={self.args})"
@@ -795,66 +793,77 @@ class command(FieldType):
         if isinstance(other, command):
             return self.executable == other.executable and self.args == other.args
         if isinstance(other, str):
-            return self._join() == other
+            return self.raw == other
         if isinstance(other, (tuple, list)):
-            return self.executable == other[0] and self.args == list(other[1:])
+            return self.executable == other[0] and self.args == (*other[1:],)
 
         return False
 
-    def _split(self, value: str) -> tuple[str, list[str]]:
-        executable, *args = shlex.split(value, posix=self._posix)
-        executable = executable.strip("'\" ")
-
-        return self._path_type(executable), args
+    def _split(self, value: str) -> tuple[str, tuple[str, ...]]:
+        if not value:
+            return "", ()
 
-    def _join(self) -> str:
-        return shlex.join([str(self.executable), *self.args])
+        executable, *args = shlex.split(value, posix=self.__path_type is posix_path)
+        return executable.strip("'\" "), (*args,)
 
-    def _pack(self) -> tuple[tuple[str, list], str]:
-        command_type = TYPE_WINDOWS if isinstance(self, windows_command) else TYPE_POSIX
-        if self.executable:
-            _exec, _ = self.executable._pack()
-            return ((_exec, self.args), command_type)
-        return (None, command_type)
-
-    @classmethod
-    def _unpack(cls, data: tuple[tuple[str, tuple] | None, int]) -> command:
-        _value, _type = data
-        if _type == TYPE_WINDOWS:
-            return windows_command(_value)
-
-        return posix_command(_value)
+    def _pack(self) -> tuple[str, int]:
+        path_type = TYPE_WINDOWS if self.__path_type is windows_path else TYPE_POSIX
+        return self.raw, path_type
 
     @classmethod
-    def from_posix(cls, value: str) -> command:
-        return posix_command(value)
+    def _unpack(cls, data: tuple[str, int]) -> command:
+        raw_str, path_type = data
+        if path_type == TYPE_POSIX:
+            return command(raw_str, path_type=posix_path)
+        if path_type == TYPE_WINDOWS:
+            return command(raw_str, path_type=windows_path)
+        # default, infer type of path from str
+        return command(raw_str)
 
-    @classmethod
-    def from_windows(cls, value: str) -> command:
-        return windows_command(value)
+    @property
+    def executable(self) -> path:
+        return self.__executable
 
+    @property
+    def args(self) -> tuple[str, ...]:
+        return self.__args
 
-class posix_command(command):
-    _posix = True
-    _path_type = posix_path
+    @executable.setter
+    def executable(self, val: str | path | None) -> None:
+        self.__executable = self.__path_type(val)
 
+    @args.setter
+    def args(self, val: str | tuple[str, ...] | list[str] | None) -> None:
+        if val is None:
+            self.__args = ()
+            return
 
-class windows_command(command):
-    _posix = False
-    _path_type = windows_path
+        if isinstance(val, str):
+            self.__args = tuple(shlex.split(val, posix=self.__path_type is posix_path))
+        elif isinstance(val, list):
+            self.__args = tuple(val)
+        else:
+            self.__args = val
 
-    def _split(self, value: str) -> tuple[str, list[str]]:
-        executable, args = super()._split(value)
-        if args:
-            args = [" ".join(args)]
+    @property
+    def raw(self) -> str:
+        exe = str(self.executable)
 
-        return executable, args
+        if " " in exe:
+            exe = shlex.quote(exe)
 
-    def _join(self) -> str:
-        arg = f" {self.args[0]}" if self.args else ""
-        executable_str = str(self.executable)
+        result = [exe]
+        # Only quote on posix paths as shlex doesn't remove the quotes on non posix paths
+        if self.__path_type is posix_path:
+            result.extend(shlex.quote(part) if " " in part else part for part in self.args)
+        else:
+            result.extend(self.args)
+        return " ".join(result)
 
-        if " " in executable_str:
-            return f"'{executable_str}'{arg}"
+    @classmethod
+    def from_posix(cls, value: str) -> command:
+        return command(value, path_type=posix_path)
 
-        return f"{executable_str}{arg}"
+    @classmethod
+    def from_windows(cls, value: str) -> command:
+        return command(value, path_type=windows_path)

flow/record/jsonpacker.py

@@ -75,10 +75,7 @@ class JsonRecordPacker:
         if isinstance(obj, fieldtypes.path):
             return str(obj)
         if isinstance(obj, fieldtypes.command):
-            return {
-                "executable": obj.executable,
-                "args": obj.args,
-            }
+            return obj.raw
 
         raise TypeError(f"Unpackable type {type(obj)}")
 

flow/record/stream.py

@@ -164,11 +164,13 @@ def record_stream(sources: list[str], selector: str | None = None) -> Iterator[R
             print("[reading from stdin]", file=sys.stderr)
 
         # Initial value for reader, in case of exception message
-        reader = "RecordReader"
+        reader: str | AbstractReader = "RecordReader"
         try:
             reader = RecordReader(src, selector=selector)
             yield from reader
-            reader.close()
+        except EOFError as e:
+            # End of file reached, likely no records in source
+            log.warning("%s(%r): %s", reader, src, e)
         except IOError as e:
             if len(sources) == 1:
                 raise
@@ -184,6 +186,9 @@ def record_stream(sources: list[str], selector: str | None = None) -> Iterator[R
             else:
                 log.warning("Exception in %r for %r: %s -- skipping to next reader", reader, src, aRepr.repr(e))
                 continue
+        finally:
+            if isinstance(reader, AbstractReader):
+                reader.close()
 
 
 class PathTemplateWriter:

flow/record/version.py

@@ -28,7 +28,7 @@ version_tuple: VERSION_TUPLE
 commit_id: COMMIT_ID
 __commit_id__: COMMIT_ID
 
-__version__ = version = '3.22.dev2'
-__version_tuple__ = version_tuple = (3, 22, 'dev2')
+__version__ = version = '3.22.dev4'
+__version_tuple__ = version_tuple = (3, 22, 'dev4')
 
 __commit_id__ = commit_id = None

{flow_record-3.22.dev2.dist-info → flow_record-3.22.dev4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flow.record
-Version: 3.22.dev2
+Version: 3.22.dev4
 Summary: A library for defining and creating structured data (called records) that can be streamed to disk or piped to other tools that use flow.record
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{flow_record-3.22.dev2.dist-info → flow_record-3.22.dev4.dist-info}/RECORD

@@ -1,13 +1,13 @@
 flow/record/__init__.py,sha256=YdIbBF-QkR4YKE6zLz6AjY953EpR0aaESH8XTCwfdMo,2338
-flow/record/base.py,sha256=Q4BsZvbRrumYsdMvFoFdyrR2FSt3lKENIEn2B5RRlDM,39965
+flow/record/base.py,sha256=DQ7K6X7Tn7NP2uN471pGFmOJRPxbMnymHKfiwFCCPnQ,40064
 flow/record/context.py,sha256=2zpAucmR-RVzjXqBf6O4eq6nKMuIs03cacHPlTBvUPY,2009
 flow/record/exceptions.py,sha256=_TLT3mWGO7b9KRxwP7FIz1a_nc9cizUuNNK5C3nPXWc,328
-flow/record/jsonpacker.py,sha256=VrlIND4pQcBGJyP_pjrkV70ldDQuzh1oblHR4hjkuHM,4444
+flow/record/jsonpacker.py,sha256=pUEoO1Ag5r2Wi7KSOX8shiOgwx2d2L9ZGV_32OGiVD0,4356
 flow/record/packer.py,sha256=lRDuf8r_mk-G2o2rU8dl9wbbuN8CnQ37q6k0pwbvFf0,6817
 flow/record/selector.py,sha256=HHgLY7ImtNPgtD-wnywhymsAgNC3DNAaylhoau3nWCA,21980
-flow/record/stream.py,sha256=R5kB8yhDLWua1cP-9bcZnAL1d2AOSPdBp3S2YYlGS7w,10983
+flow/record/stream.py,sha256=EGk_HMTCeDfsNavdMzFV_IrOdwtQKw3SNKQEJBoB3LU,11224
 flow/record/utils.py,sha256=l2bxnVhzWqaBFaGz30vgCmUuVE4mo7ehQuxC3dC-ozM,4421
-flow/record/version.py,sha256=T4NYT52v19tqWhTJmaoeG2ZbVmBQ-ApSBVdSQCTNuXA,714
+flow/record/version.py,sha256=kAeAhSSYdbUawpAl58lsxIATnUGGwaT4bTBpuO-FJE0,714
 flow/record/whitelist.py,sha256=YyTAXMZSiYSzkXhASkrHDHgbpLC-tZaKAs7pfOADBcQ,775
 flow/record/adapter/__init__.py,sha256=oTC0J7xXIxoCc3pEO8yUiIi5ZpVhKMulEYJ2FbQV8xY,1425
 flow/record/adapter/archive.py,sha256=1RpKAPwIMD42x0j27zgFfOTW3xbhsc33QCXHyQxPg98,1112
@@ -25,7 +25,7 @@ flow/record/adapter/sqlite.py,sha256=Nmr8DYI7oLZA06u8FitndlKsPa96uHib8_V99gnrqwc
 flow/record/adapter/stream.py,sha256=ZIG9KvG39zy0IJ0o_DTVEGOTcrdr5kRR8hf0wCynldg,1826
 flow/record/adapter/text.py,sha256=PfCnQmb7FTSxjUghR6mUudAtBaSUY2ywW630rYic3aY,2038
 flow/record/adapter/xlsx.py,sha256=D9g6asOTM1BvlOAOjQngP9bn8QHB8W-OH7L_kcI_2Ec,5706
-flow/record/fieldtypes/__init__.py,sha256=7uipEnCvR3IuuF6rg4KvGHgbQ9wUNAZYbRO5h5cPxfI,27386
+flow/record/fieldtypes/__init__.py,sha256=KP7VzWsxoW365P1BRUPf4JkL9VLWBkEHbYiIhdJLM3U,27976
 flow/record/fieldtypes/credential.py,sha256=AjJsHmCdNxiDFUV-z81eu3NUGkbqN8QwhgFejPDVRHs,148
 flow/record/fieldtypes/net/__init__.py,sha256=snPNt9_BEh5vGGQi0ZVSPHkwHTq2Qic0BKsGWNd92Qk,370
 flow/record/fieldtypes/net/ip.py,sha256=AgfM11NyTIuYh_iXnzxfLHXHX1N1qewTlCibhICiFjg,3491
@@ -35,10 +35,10 @@ flow/record/fieldtypes/net/udp.py,sha256=_M85FWHktqPPBDr_aNzVMKAKZZwNEovrWmu-7yV
 flow/record/tools/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 flow/record/tools/geoip.py,sha256=yyTMTZldafz1yZ9F3IkiRH1_hFUyWPMQaMYvljQbKMk,5417
 flow/record/tools/rdump.py,sha256=TRtcQsfJE3rNYb8D8NubVa4jgDzQX7gxm0B6_TzoXm0,14270
-flow_record-3.22.dev2.dist-info/licenses/COPYRIGHT,sha256=MemuVEitZl6nTA3wCiJXY3v-Y5cYgfCzTodptjpZ9Tw,298
-flow_record-3.22.dev2.dist-info/licenses/LICENSE,sha256=DZak_2itbUtvHzD3E7GNUYSRK6jdOJ-GqncQ2weavLA,34523
-flow_record-3.22.dev2.dist-info/METADATA,sha256=CMiqBNPebM2yjgRTQVyl4nvyg2K3nydF1rGb6MQ4DoQ,6214
-flow_record-3.22.dev2.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-flow_record-3.22.dev2.dist-info/entry_points.txt,sha256=BYPSrpFXabKCvE97dU3Bj4G_cfozaxsxsN7IHu6Vkpo,93
-flow_record-3.22.dev2.dist-info/top_level.txt,sha256=mZX7nA6le1XNJV9ujgVL0yyesYwj3fMwHSm3zGwjNbU,5
-flow_record-3.22.dev2.dist-info/RECORD,,
+flow_record-3.22.dev4.dist-info/licenses/COPYRIGHT,sha256=MemuVEitZl6nTA3wCiJXY3v-Y5cYgfCzTodptjpZ9Tw,298
+flow_record-3.22.dev4.dist-info/licenses/LICENSE,sha256=DZak_2itbUtvHzD3E7GNUYSRK6jdOJ-GqncQ2weavLA,34523
+flow_record-3.22.dev4.dist-info/METADATA,sha256=_Dvd4-b5UGmvEp_fAxREYlNOS4Z9MsVSqG0Be1nGFd4,6214
+flow_record-3.22.dev4.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+flow_record-3.22.dev4.dist-info/entry_points.txt,sha256=BYPSrpFXabKCvE97dU3Bj4G_cfozaxsxsN7IHu6Vkpo,93
+flow_record-3.22.dev4.dist-info/top_level.txt,sha256=mZX7nA6le1XNJV9ujgVL0yyesYwj3fMwHSm3zGwjNbU,5
+flow_record-3.22.dev4.dist-info/RECORD,,