maco 1.2.9__tar.gz → 1.2.11__tar.gz

{maco-1.2.9/maco.egg-info → maco-1.2.11}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.2
 Name: maco
-Version: 1.2.9
+Version: 1.2.11
 Author: sl-govau
 Maintainer: cccs-rs
 License: MIT License

{maco-1.2.9/model_setup → maco-1.2.11}/maco/cli.py

@@ -92,6 +92,7 @@ def process_filesystem(
     force: bool,
     include_base64: bool,
     create_venv: bool = False,
+    skip_install: bool = False,
 ) -> Tuple[int, int, int]:
     """Process filesystem with extractors and print results of extraction.
 
@@ -99,7 +100,9 @@ def process_filesystem(
     """
     if force:
         logger.warning("force execute will cause errors if an extractor requires a yara rule hit during execution")
-    collected = collector.Collector(path_extractors, include=include, exclude=exclude, create_venv=create_venv)
+    collected = collector.Collector(
+        path_extractors, include=include, exclude=exclude, create_venv=create_venv, skip_install=skip_install
+    )
 
     logger.info(f"extractors loaded: {[x for x in collected.extractors.keys()]}\n")
     for _, extractor in collected.extractors.items():
@@ -191,6 +194,11 @@ def main():
         "This runs much slower than the alternative but may be necessary "
         "when there are many extractors with conflicting dependencies.",
     )
+    parser.add_argument(
+        "--force_install",
+        action="store_true",
+        help="Force installation of Python dependencies for extractors (in both host and virtual environments).",
+    )
     args = parser.parse_args()
     inc = args.include.split(",") if args.include else []
     exc = args.exclude.split(",") if args.exclude else []
@@ -236,6 +244,7 @@ def main():
         force=args.force,
         include_base64=args.base64,
         create_venv=args.create_venv,
+        skip_install=not args.force_install,
     )
 
 

{maco-1.2.9 → maco-1.2.11}/maco/collector.py

@@ -67,6 +67,7 @@ class Collector:
         include: List[str] = None,
         exclude: List[str] = None,
         create_venv: bool = False,
+        skip_install: bool = False,
     ):
         """Discover and load extractors from file system."""
         # maco requires the extractor to be imported directly, so ensure they are available on the path
@@ -135,6 +136,7 @@ class Collector:
                     root_directory=path_extractors,
                     scanner=yara.compile(source=utils.MACO_YARA_RULE),
                     create_venv=create_venv and os.path.isdir(path_extractors),
+                    skip_install=skip_install,
                 ),
             )
             p.start()

{maco-1.2.9 → maco-1.2.11}/maco/utils.py

@@ -39,8 +39,8 @@ logger = logging.getLogger("maco.lib.utils")
 
 VENV_DIRECTORY_NAME = ".venv"
 
-RELATIVE_FROM_RE = re.compile(r"from (\.+)")
-RELATIVE_FROM_IMPORT_RE = re.compile(r"from (\.+) import")
+RELATIVE_FROM_RE = re.compile(rb"from (\.+)")
+RELATIVE_FROM_IMPORT_RE = re.compile(rb"from (\.+) import")
 
 UV_BIN = find_uv_bin()
 
@@ -171,19 +171,19 @@ def scan_for_extractors(root_directory: str, scanner: yara.Rules, logger: Logger
                 # Scan Python file for potential extractors
                 if package:
                     # Inspect the contents and look for any relative import issues
-                    with open(path, "r") as f:
+                    with open(path, "rb") as f:
                         data = f.read()
 
-                    with open(path, "w") as f:
+                    with open(path, "wb") as f:
                         # Replace any relative importing with absolute
                         curr_dir = os.path.dirname(path)
                         split = curr_dir.split("/")[::-1]
                         for pattern in [RELATIVE_FROM_IMPORT_RE, RELATIVE_FROM_RE]:
                             for match in pattern.findall(data):
-                                depth = match.count(".")
+                                depth = match.count(b".")
                                 abspath = ".".join(split[depth - 1 : split.index(package) + 1][::-1])
                                 abspath += "." if pattern == RELATIVE_FROM_RE else ""
-                                data = data.replace(f"from {match}", f"from {abspath}", 1)
+                                data = data.replace(f"from {match.decode()}".encode(), f"from {abspath}".encode(), 1)
                         f.write(data)
 
                 if scanner.match(path):
@@ -450,9 +450,19 @@ def run_extractor(
         key = f"{module_name}_{extractor_class}"
         if key not in _loaded_extractors:
             # dynamic import of extractor
-            mod = importlib.import_module(module_name)
-            extractor_cls = mod.__getattribute__(extractor_class)
-            extractor = extractor_cls()
+            try:
+                # Add the correct directory to the PATH before attempting to load the extractor
+                import_path = module_path[: -4 - len(module_name)]
+                sys.path.insert(1, import_path)
+                mod = importlib.import_module(module_name)
+                extractor_cls = mod.__getattribute__(extractor_class)
+                extractor = extractor_cls()
+
+                # Add to cache
+                _loaded_extractors[key] = extractor
+            finally:
+                sys.path.pop(1)
+
         else:
             # retrieve cached extractor
             extractor = _loaded_extractors[key]

{maco-1.2.9 → maco-1.2.11/maco.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.1
+Metadata-Version: 2.2
 Name: maco
-Version: 1.2.9
+Version: 1.2.11
 Author: sl-govau
 Maintainer: cccs-rs
 License: MIT License

{maco-1.2.9 → maco-1.2.11/model_setup}/maco/cli.py

@@ -92,6 +92,7 @@ def process_filesystem(
     force: bool,
     include_base64: bool,
     create_venv: bool = False,
+    skip_install: bool = False,
 ) -> Tuple[int, int, int]:
     """Process filesystem with extractors and print results of extraction.
 
@@ -99,7 +100,9 @@ def process_filesystem(
     """
     if force:
         logger.warning("force execute will cause errors if an extractor requires a yara rule hit during execution")
-    collected = collector.Collector(path_extractors, include=include, exclude=exclude, create_venv=create_venv)
+    collected = collector.Collector(
+        path_extractors, include=include, exclude=exclude, create_venv=create_venv, skip_install=skip_install
+    )
 
     logger.info(f"extractors loaded: {[x for x in collected.extractors.keys()]}\n")
     for _, extractor in collected.extractors.items():
@@ -191,6 +194,11 @@ def main():
         "This runs much slower than the alternative but may be necessary "
         "when there are many extractors with conflicting dependencies.",
     )
+    parser.add_argument(
+        "--force_install",
+        action="store_true",
+        help="Force installation of Python dependencies for extractors (in both host and virtual environments).",
+    )
     args = parser.parse_args()
     inc = args.include.split(",") if args.include else []
     exc = args.exclude.split(",") if args.exclude else []
@@ -236,6 +244,7 @@ def main():
         force=args.force,
         include_base64=args.base64,
         create_venv=args.create_venv,
+        skip_install=not args.force_install,
     )
 
 

{maco-1.2.9 → maco-1.2.11}/model_setup/maco/collector.py

@@ -67,6 +67,7 @@ class Collector:
         include: List[str] = None,
         exclude: List[str] = None,
         create_venv: bool = False,
+        skip_install: bool = False,
     ):
         """Discover and load extractors from file system."""
         # maco requires the extractor to be imported directly, so ensure they are available on the path
@@ -135,6 +136,7 @@ class Collector:
                     root_directory=path_extractors,
                     scanner=yara.compile(source=utils.MACO_YARA_RULE),
                     create_venv=create_venv and os.path.isdir(path_extractors),
+                    skip_install=skip_install,
                 ),
             )
             p.start()

{maco-1.2.9 → maco-1.2.11}/model_setup/maco/utils.py

@@ -39,8 +39,8 @@ logger = logging.getLogger("maco.lib.utils")
 
 VENV_DIRECTORY_NAME = ".venv"
 
-RELATIVE_FROM_RE = re.compile(r"from (\.+)")
-RELATIVE_FROM_IMPORT_RE = re.compile(r"from (\.+) import")
+RELATIVE_FROM_RE = re.compile(rb"from (\.+)")
+RELATIVE_FROM_IMPORT_RE = re.compile(rb"from (\.+) import")
 
 UV_BIN = find_uv_bin()
 
@@ -171,19 +171,19 @@ def scan_for_extractors(root_directory: str, scanner: yara.Rules, logger: Logger
                 # Scan Python file for potential extractors
                 if package:
                     # Inspect the contents and look for any relative import issues
-                    with open(path, "r") as f:
+                    with open(path, "rb") as f:
                         data = f.read()
 
-                    with open(path, "w") as f:
+                    with open(path, "wb") as f:
                         # Replace any relative importing with absolute
                         curr_dir = os.path.dirname(path)
                         split = curr_dir.split("/")[::-1]
                         for pattern in [RELATIVE_FROM_IMPORT_RE, RELATIVE_FROM_RE]:
                             for match in pattern.findall(data):
-                                depth = match.count(".")
+                                depth = match.count(b".")
                                 abspath = ".".join(split[depth - 1 : split.index(package) + 1][::-1])
                                 abspath += "." if pattern == RELATIVE_FROM_RE else ""
-                                data = data.replace(f"from {match}", f"from {abspath}", 1)
+                                data = data.replace(f"from {match.decode()}".encode(), f"from {abspath}".encode(), 1)
                         f.write(data)
 
                 if scanner.match(path):
@@ -450,9 +450,19 @@ def run_extractor(
         key = f"{module_name}_{extractor_class}"
         if key not in _loaded_extractors:
             # dynamic import of extractor
-            mod = importlib.import_module(module_name)
-            extractor_cls = mod.__getattribute__(extractor_class)
-            extractor = extractor_cls()
+            try:
+                # Add the correct directory to the PATH before attempting to load the extractor
+                import_path = module_path[: -4 - len(module_name)]
+                sys.path.insert(1, import_path)
+                mod = importlib.import_module(module_name)
+                extractor_cls = mod.__getattribute__(extractor_class)
+                extractor = extractor_cls()
+
+                # Add to cache
+                _loaded_extractors[key] = extractor
+            finally:
+                sys.path.pop(1)
+
         else:
             # retrieve cached extractor
             extractor = _loaded_extractors[key]