maco 1.2.7__tar.gz → 1.2.9__tar.gz

{maco-1.2.7/maco.egg-info → maco-1.2.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: maco
-Version: 1.2.7
+Version: 1.2.9
 Author: sl-govau
 Maintainer: cccs-rs
 License: MIT License
@@ -35,6 +35,7 @@ Requires-Dist: tomli>=1.1.0; python_version < "3.11"
 Requires-Dist: uv
 Requires-Dist: yara-python
 Requires-Dist: yara-x==0.11.0
+Requires-Dist: multiprocess>=0.70.17
 
 # Maco - Malware config extractor framework
 

{maco-1.2.7/model_setup → maco-1.2.9}/maco/cli.py

@@ -123,10 +123,15 @@ def process_filesystem(
         logger.error(f"not file or folder: {path_samples}")
         exit(2)
     try:
-        for path, dirs, files in walker:
+        base_directory = os.path.abspath(path_samples)
+        for path, _, files in walker:
             for file in files:
                 num_analysed += 1
-                path_file = os.path.join(path, file)
+                path_file = os.path.abspath(os.path.join(path, file))
+                if not path_file.startswith(base_directory):
+                    logger.error(f"Attempted path traversal detected: {path_file}")
+                    continue
+
                 try:
                     with open(path_file, "rb") as stream:
                         resp = process_file(

{maco-1.2.7 → maco-1.2.9}/maco/collector.py

@@ -5,11 +5,11 @@ import logging
 import logging.handlers
 import os
 import sys
-from multiprocessing import Manager, Process, Queue
 from tempfile import NamedTemporaryFile
 from types import ModuleType
-from typing import Any, BinaryIO, Dict, List, Union
+from typing import Any, BinaryIO, Dict, List, TypedDict, Union
 
+from multiprocess import Manager, Process, Queue
 from pydantic import BaseModel
 
 from maco import extractor, model, utils, yara
@@ -40,6 +40,26 @@ def _verify_response(resp: Union[BaseModel, dict]) -> Dict:
     return resp.model_dump(exclude_defaults=True)
 
 
+class ExtractorMetadata(TypedDict):
+    """Extractor-supplied metadata."""
+
+    author: str
+    family: str
+    last_modified: str
+    sharing: str
+    description: str
+
+
+class ExtractorRegistration(TypedDict):
+    """Registration collected by the collector for a single extractor."""
+
+    venv: str
+    module_path: str
+    module_name: str
+    extractor_class: str
+    metadata: ExtractorMetadata
+
+
 class Collector:
     def __init__(
         self,
@@ -60,7 +80,7 @@ class Collector:
 
         path_extractors = os.path.realpath(path_extractors)
         self.path: str = path_extractors
-        self.extractors: Dict[str, Dict[str, str]] = {}
+        self.extractors: Dict[str, ExtractorRegistration] = {}
 
         with Manager() as manager:
             extractors = manager.dict()

{maco-1.2.7 → maco-1.2.9}/maco/utils.py

@@ -6,7 +6,6 @@ import inspect
 import json
 import logging
 import logging.handlers
-import multiprocessing
 import os
 import re
 import shutil
@@ -14,6 +13,8 @@ import subprocess
 import sys
 import tempfile
 
+from multiprocess import Queue
+
 from maco import yara
 
 if sys.version_info >= (3, 11):
@@ -390,7 +391,7 @@ def register_extractors(
                 break
 
 
-def proxy_logging(queue: multiprocessing.Queue, callback: Callable[[ModuleType, str], None], *args, **kwargs):
+def proxy_logging(queue: Queue, callback: Callable[[ModuleType, str], None], *args, **kwargs):
     """Ensures logging is set up correctly for a child process and then executes the callback."""
     logger = logging.getLogger()
     qh = logging.handlers.QueueHandler(queue)

{maco-1.2.7 → maco-1.2.9/maco.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: maco
-Version: 1.2.7
+Version: 1.2.9
 Author: sl-govau
 Maintainer: cccs-rs
 License: MIT License
@@ -35,6 +35,7 @@ Requires-Dist: tomli>=1.1.0; python_version < "3.11"
 Requires-Dist: uv
 Requires-Dist: yara-python
 Requires-Dist: yara-x==0.11.0
+Requires-Dist: multiprocess>=0.70.17
 
 # Maco - Malware config extractor framework
 

{maco-1.2.7 → maco-1.2.9}/maco.egg-info/requires.txt

@@ -3,6 +3,7 @@ pydantic>=2.0.0
 uv
 yara-python
 yara-x==0.11.0
+multiprocess>=0.70.17
 
 [:python_version < "3.11"]
 tomli>=1.1.0

{maco-1.2.7 → maco-1.2.9/model_setup}/maco/cli.py

@@ -123,10 +123,15 @@ def process_filesystem(
         logger.error(f"not file or folder: {path_samples}")
         exit(2)
     try:
-        for path, dirs, files in walker:
+        base_directory = os.path.abspath(path_samples)
+        for path, _, files in walker:
             for file in files:
                 num_analysed += 1
-                path_file = os.path.join(path, file)
+                path_file = os.path.abspath(os.path.join(path, file))
+                if not path_file.startswith(base_directory):
+                    logger.error(f"Attempted path traversal detected: {path_file}")
+                    continue
+
                 try:
                     with open(path_file, "rb") as stream:
                         resp = process_file(

{maco-1.2.7 → maco-1.2.9}/model_setup/maco/collector.py

@@ -5,11 +5,11 @@ import logging
 import logging.handlers
 import os
 import sys
-from multiprocessing import Manager, Process, Queue
 from tempfile import NamedTemporaryFile
 from types import ModuleType
-from typing import Any, BinaryIO, Dict, List, Union
+from typing import Any, BinaryIO, Dict, List, TypedDict, Union
 
+from multiprocess import Manager, Process, Queue
 from pydantic import BaseModel
 
 from maco import extractor, model, utils, yara
@@ -40,6 +40,26 @@ def _verify_response(resp: Union[BaseModel, dict]) -> Dict:
     return resp.model_dump(exclude_defaults=True)
 
 
+class ExtractorMetadata(TypedDict):
+    """Extractor-supplied metadata."""
+
+    author: str
+    family: str
+    last_modified: str
+    sharing: str
+    description: str
+
+
+class ExtractorRegistration(TypedDict):
+    """Registration collected by the collector for a single extractor."""
+
+    venv: str
+    module_path: str
+    module_name: str
+    extractor_class: str
+    metadata: ExtractorMetadata
+
+
 class Collector:
     def __init__(
         self,
@@ -60,7 +80,7 @@ class Collector:
 
         path_extractors = os.path.realpath(path_extractors)
         self.path: str = path_extractors
-        self.extractors: Dict[str, Dict[str, str]] = {}
+        self.extractors: Dict[str, ExtractorRegistration] = {}
 
         with Manager() as manager:
             extractors = manager.dict()

{maco-1.2.7 → maco-1.2.9}/model_setup/maco/utils.py

@@ -6,7 +6,6 @@ import inspect
 import json
 import logging
 import logging.handlers
-import multiprocessing
 import os
 import re
 import shutil
@@ -14,6 +13,8 @@ import subprocess
 import sys
 import tempfile
 
+from multiprocess import Queue
+
 from maco import yara
 
 if sys.version_info >= (3, 11):
@@ -390,7 +391,7 @@ def register_extractors(
                 break
 
 
-def proxy_logging(queue: multiprocessing.Queue, callback: Callable[[ModuleType, str], None], *args, **kwargs):
+def proxy_logging(queue: Queue, callback: Callable[[ModuleType, str], None], *args, **kwargs):
     """Ensures logging is set up correctly for a child process and then executes the callback."""
     logger = logging.getLogger()
     qh = logging.handlers.QueueHandler(queue)

{maco-1.2.7 → maco-1.2.9}/requirements.txt

@@ -4,3 +4,4 @@ tomli >= 1.1.0 ; python_version < "3.11"
 uv
 yara-python
 yara-x==0.11.0
+multiprocess>=0.70.17