maco 1.2.7__py3-none-any.whl → 1.2.9__py3-none-any.whl

maco/cli.py

@@ -123,10 +123,15 @@ def process_filesystem(
         logger.error(f"not file or folder: {path_samples}")
         exit(2)
     try:
-        for path, dirs, files in walker:
+        base_directory = os.path.abspath(path_samples)
+        for path, _, files in walker:
             for file in files:
                 num_analysed += 1
-                path_file = os.path.join(path, file)
+                path_file = os.path.abspath(os.path.join(path, file))
+                if not path_file.startswith(base_directory):
+                    logger.error(f"Attempted path traversal detected: {path_file}")
+                    continue
+
                 try:
                     with open(path_file, "rb") as stream:
                         resp = process_file(

maco/collector.py

@@ -5,11 +5,11 @@ import logging
 import logging.handlers
 import os
 import sys
-from multiprocessing import Manager, Process, Queue
 from tempfile import NamedTemporaryFile
 from types import ModuleType
-from typing import Any, BinaryIO, Dict, List, Union
+from typing import Any, BinaryIO, Dict, List, TypedDict, Union
 
+from multiprocess import Manager, Process, Queue
 from pydantic import BaseModel
 
 from maco import extractor, model, utils, yara
@@ -40,6 +40,26 @@ def _verify_response(resp: Union[BaseModel, dict]) -> Dict:
     return resp.model_dump(exclude_defaults=True)
 
 
+class ExtractorMetadata(TypedDict):
+    """Extractor-supplied metadata."""
+
+    author: str
+    family: str
+    last_modified: str
+    sharing: str
+    description: str
+
+
+class ExtractorRegistration(TypedDict):
+    """Registration collected by the collector for a single extractor."""
+
+    venv: str
+    module_path: str
+    module_name: str
+    extractor_class: str
+    metadata: ExtractorMetadata
+
+
 class Collector:
     def __init__(
         self,
@@ -60,7 +80,7 @@ class Collector:
 
         path_extractors = os.path.realpath(path_extractors)
         self.path: str = path_extractors
-        self.extractors: Dict[str, Dict[str, str]] = {}
+        self.extractors: Dict[str, ExtractorRegistration] = {}
 
         with Manager() as manager:
             extractors = manager.dict()

maco/utils.py

@@ -6,7 +6,6 @@ import inspect
 import json
 import logging
 import logging.handlers
-import multiprocessing
 import os
 import re
 import shutil
@@ -14,6 +13,8 @@ import subprocess
 import sys
 import tempfile
 
+from multiprocess import Queue
+
 from maco import yara
 
 if sys.version_info >= (3, 11):
@@ -390,7 +391,7 @@ def register_extractors(
                 break
 
 
-def proxy_logging(queue: multiprocessing.Queue, callback: Callable[[ModuleType, str], None], *args, **kwargs):
+def proxy_logging(queue: Queue, callback: Callable[[ModuleType, str], None], *args, **kwargs):
     """Ensures logging is set up correctly for a child process and then executes the callback."""
     logger = logging.getLogger()
     qh = logging.handlers.QueueHandler(queue)

{maco-1.2.7.dist-info → maco-1.2.9.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: maco
-Version: 1.2.7
+Version: 1.2.9
 Author: sl-govau
 Maintainer: cccs-rs
 License: MIT License
@@ -35,6 +35,7 @@ Requires-Dist: tomli>=1.1.0; python_version < "3.11"
 Requires-Dist: uv
 Requires-Dist: yara-python
 Requires-Dist: yara-x==0.11.0
+Requires-Dist: multiprocess>=0.70.17
 
 # Maco - Malware config extractor framework
 

{maco-1.2.7.dist-info → maco-1.2.9.dist-info}/RECORD

@@ -9,19 +9,19 @@ demo_extractors/complex/complex.py,sha256=tXrzj_zWIXbTOwj7Lezapk-qkrM-lfwcyjd5m-
 demo_extractors/complex/complex_utils.py,sha256=aec8kJsYUrMPo-waihkVLt-0QpiOPkw7dDqfT9MNuHk,123
 maco/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 maco/base_test.py,sha256=cjGLEy2c69wl9sjn74QFz7X-VxWOfdin4W8MvYsXc4Q,2718
-maco/cli.py,sha256=NTzV8eu9V0qQNttRo592j-Rdzac7q1NAMraqJF2h_6k,8171
-maco/collector.py,sha256=LraWYlCA72FCmQP0dHWc-ekd7R1SxR6h6rMD95_6mMs,7077
+maco/cli.py,sha256=pPS8euWaLV-6csBCCzT1Mtc7GwP7a_RikDjfUYxoxU8,8415
+maco/collector.py,sha256=cBZEHx5qjFwf-EfAgEmXlu4kT4rWZkcDE926gBrOoN8,7493
 maco/extractor.py,sha256=uGSGiCQ4jd8jFmfw2T99BGcY5iQJzXHcG_RoTIxClTE,2802
-maco/utils.py,sha256=RbG36i04iWoe5gBUxbnbJ_lDvYY5OkYtiy0EdXF9OHw,20870
+maco/utils.py,sha256=-ESB2JdfGCubEBTp7yt5M57z-FQUeYI1bmC37vNnsX0,20863
 maco/yara.py,sha256=8RVaGyeUWY5f8_wfQ25lDX1bcXsb_VoSja85ZC2SqGw,2913
 maco/model/__init__.py,sha256=ULdyHx8R5D2ICHZo3VoCk1YTlewTok36TYIpwx__pNY,45
 maco/model/model.py,sha256=4uY88WphbP3iu-L2WjuYwtgZCS_wNul_hr0bAVuTpvc,23740
 model_setup/maco/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 model_setup/maco/base_test.py,sha256=cjGLEy2c69wl9sjn74QFz7X-VxWOfdin4W8MvYsXc4Q,2718
-model_setup/maco/cli.py,sha256=NTzV8eu9V0qQNttRo592j-Rdzac7q1NAMraqJF2h_6k,8171
-model_setup/maco/collector.py,sha256=LraWYlCA72FCmQP0dHWc-ekd7R1SxR6h6rMD95_6mMs,7077
+model_setup/maco/cli.py,sha256=pPS8euWaLV-6csBCCzT1Mtc7GwP7a_RikDjfUYxoxU8,8415
+model_setup/maco/collector.py,sha256=cBZEHx5qjFwf-EfAgEmXlu4kT4rWZkcDE926gBrOoN8,7493
 model_setup/maco/extractor.py,sha256=uGSGiCQ4jd8jFmfw2T99BGcY5iQJzXHcG_RoTIxClTE,2802
-model_setup/maco/utils.py,sha256=RbG36i04iWoe5gBUxbnbJ_lDvYY5OkYtiy0EdXF9OHw,20870
+model_setup/maco/utils.py,sha256=-ESB2JdfGCubEBTp7yt5M57z-FQUeYI1bmC37vNnsX0,20863
 model_setup/maco/yara.py,sha256=8RVaGyeUWY5f8_wfQ25lDX1bcXsb_VoSja85ZC2SqGw,2913
 model_setup/maco/model/__init__.py,sha256=ULdyHx8R5D2ICHZo3VoCk1YTlewTok36TYIpwx__pNY,45
 model_setup/maco/model/model.py,sha256=4uY88WphbP3iu-L2WjuYwtgZCS_wNul_hr0bAVuTpvc,23740
@@ -36,9 +36,9 @@ tests/extractors/basic_longer.py,sha256=1ClU2QD-Y0TOl_loNFvEqIEpTR5TSVJ6zg9ZmC-E
 tests/extractors/test_basic.py,sha256=FLKekfSGM69HaiF7Vu_7D7KDXHZko-9hZkMO8_DoyYA,697
 tests/extractors/bob/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 tests/extractors/bob/bob.py,sha256=G5aOoz58J0ZQK2_lA7HRxAzeLzBxssWxBTZcv1pSbi8,176
-maco-1.2.7.dist-info/LICENSE.md,sha256=gMSjshPhXvV_F1qxmeNkKdBqGWkd__fEJf4glS504bM,1478
-maco-1.2.7.dist-info/METADATA,sha256=09_OhgEFJ1kNPB6tg0NiJQmIrlLDB51bbR2rnrdW-wU,15855
-maco-1.2.7.dist-info/WHEEL,sha256=PZUExdf71Ui_so67QXpySuHtCi3-J3wvF4ORK6k_S8U,91
-maco-1.2.7.dist-info/entry_points.txt,sha256=TpcwG1gedIg8Y7a9ZOv8aQpuwEUftCefDrAjzeP-o6U,39
-maco-1.2.7.dist-info/top_level.txt,sha256=iMRwuzmrHA3zSwiSeMIl6FWhzRpn_st-I4fAv-kw5_o,49
-maco-1.2.7.dist-info/RECORD,,
+maco-1.2.9.dist-info/LICENSE.md,sha256=gMSjshPhXvV_F1qxmeNkKdBqGWkd__fEJf4glS504bM,1478
+maco-1.2.9.dist-info/METADATA,sha256=zkoQkUI4Ll9ii6AkDJTi01Y0-53eNfgoNbqK5CyB6es,15892
+maco-1.2.9.dist-info/WHEEL,sha256=PZUExdf71Ui_so67QXpySuHtCi3-J3wvF4ORK6k_S8U,91
+maco-1.2.9.dist-info/entry_points.txt,sha256=TpcwG1gedIg8Y7a9ZOv8aQpuwEUftCefDrAjzeP-o6U,39
+maco-1.2.9.dist-info/top_level.txt,sha256=iMRwuzmrHA3zSwiSeMIl6FWhzRpn_st-I4fAv-kw5_o,49
+maco-1.2.9.dist-info/RECORD,,

model_setup/maco/cli.py

@@ -123,10 +123,15 @@ def process_filesystem(
         logger.error(f"not file or folder: {path_samples}")
         exit(2)
     try:
-        for path, dirs, files in walker:
+        base_directory = os.path.abspath(path_samples)
+        for path, _, files in walker:
             for file in files:
                 num_analysed += 1
-                path_file = os.path.join(path, file)
+                path_file = os.path.abspath(os.path.join(path, file))
+                if not path_file.startswith(base_directory):
+                    logger.error(f"Attempted path traversal detected: {path_file}")
+                    continue
+
                 try:
                     with open(path_file, "rb") as stream:
                         resp = process_file(

model_setup/maco/collector.py

@@ -5,11 +5,11 @@ import logging
 import logging.handlers
 import os
 import sys
-from multiprocessing import Manager, Process, Queue
 from tempfile import NamedTemporaryFile
 from types import ModuleType
-from typing import Any, BinaryIO, Dict, List, Union
+from typing import Any, BinaryIO, Dict, List, TypedDict, Union
 
+from multiprocess import Manager, Process, Queue
 from pydantic import BaseModel
 
 from maco import extractor, model, utils, yara
@@ -40,6 +40,26 @@ def _verify_response(resp: Union[BaseModel, dict]) -> Dict:
     return resp.model_dump(exclude_defaults=True)
 
 
+class ExtractorMetadata(TypedDict):
+    """Extractor-supplied metadata."""
+
+    author: str
+    family: str
+    last_modified: str
+    sharing: str
+    description: str
+
+
+class ExtractorRegistration(TypedDict):
+    """Registration collected by the collector for a single extractor."""
+
+    venv: str
+    module_path: str
+    module_name: str
+    extractor_class: str
+    metadata: ExtractorMetadata
+
+
 class Collector:
     def __init__(
         self,
@@ -60,7 +80,7 @@ class Collector:
 
         path_extractors = os.path.realpath(path_extractors)
         self.path: str = path_extractors
-        self.extractors: Dict[str, Dict[str, str]] = {}
+        self.extractors: Dict[str, ExtractorRegistration] = {}
 
         with Manager() as manager:
             extractors = manager.dict()

model_setup/maco/utils.py

@@ -6,7 +6,6 @@ import inspect
 import json
 import logging
 import logging.handlers
-import multiprocessing
 import os
 import re
 import shutil
@@ -14,6 +13,8 @@ import subprocess
 import sys
 import tempfile
 
+from multiprocess import Queue
+
 from maco import yara
 
 if sys.version_info >= (3, 11):
@@ -390,7 +391,7 @@ def register_extractors(
                 break
 
 
-def proxy_logging(queue: multiprocessing.Queue, callback: Callable[[ModuleType, str], None], *args, **kwargs):
+def proxy_logging(queue: Queue, callback: Callable[[ModuleType, str], None], *args, **kwargs):
     """Ensures logging is set up correctly for a child process and then executes the callback."""
     logger = logging.getLogger()
     qh = logging.handlers.QueueHandler(queue)