sandbox-cli 0.2.26__tar.gz → 0.2.28__tar.gz

{sandbox_cli-0.2.26 → sandbox_cli-0.2.28}/.gitignore

@@ -127,6 +127,7 @@ venv/
 ENV/
 env.bak/
 venv.bak/
+.nix-venv
 
 # Spyder project settings
 .spyderproject

{sandbox_cli-0.2.26 → sandbox_cli-0.2.28}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sandbox-cli
-Version: 0.2.26
+Version: 0.2.28
 Summary: Command line tool for interaction with sandboxes
 Project-URL: Homepage, https://github.com/Security-Experts-Community/sandbox-cli
 Project-URL: Documentation, https://security-experts-community.github.io/sandbox-cli
@@ -16,7 +16,7 @@ Requires-Dist: asyncssh>=2.19.0
 Requires-Dist: cryptography>=44.0.0
 Requires-Dist: cyclopts>=3.9.0
 Requires-Dist: docker>=7.1.0
-Requires-Dist: ptsandbox
+Requires-Dist: ptsandbox>=5.0.0
 Requires-Dist: pyzipper>=0.3.6
 Requires-Dist: rich>=13.9.4
 Requires-Dist: zstandard>=0.23.0
@@ -55,9 +55,8 @@ pip install sandbox-cli
 
 NixOS:
 
-```
-Add inputs.sandbox-cli.overlays.default to your nixpkgs overlay
-TBA: ...
+```sh
+nix shell 'github:Security-Experts-Community/sandbox-cli'
 ```
 
 ### Config

{sandbox_cli-0.2.26 → sandbox_cli-0.2.28}/README.md

@@ -31,9 +31,8 @@ pip install sandbox-cli
 
 NixOS:
 
-```
-Add inputs.sandbox-cli.overlays.default to your nixpkgs overlay
-TBA: ...
+```sh
+nix shell 'github:Security-Experts-Community/sandbox-cli'
 ```
 
 ### Config

{sandbox_cli-0.2.26 → sandbox_cli-0.2.28}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sandbox-cli"
-version = "0.2.26"
+version = "0.2.28"
 description = "Command line tool for interaction with sandboxes"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -13,7 +13,7 @@ dependencies = [
   "cryptography>=44.0.0",
   "cyclopts>=3.9.0",
   "docker>=7.1.0",
-  "ptsandbox",
+  "ptsandbox>=5.0.0",
   "pyzipper>=0.3.6",
   "rich>=13.9.4",
   "zstandard>=0.23.0",

{sandbox_cli-0.2.26 → sandbox_cli-0.2.28}/sandbox_cli/cli/scanner/__init__.py

@@ -7,7 +7,7 @@ from cyclopts import App, Parameter, Token, validators
 from ptsandbox.models import VNCMode
 
 from sandbox_cli.console import console
-from sandbox_cli.internal.config import VMImage, settings
+from sandbox_cli.internal.config import Platform, VMImage, settings
 from sandbox_cli.internal.helpers import validate_key
 from sandbox_cli.utils.scanner import scan_internal
 from sandbox_cli.utils.scanner.advanced import scan_internal_advanced
@@ -34,6 +34,20 @@ def image_converter(_: Any, tokens: Sequence[Token]) -> set[VMImage | str]:
     return images
 
 
+def rules_path_resolver(_: Any, tokens: Sequence[Token]) -> Path | None:
+    path: Path | None = None
+    for token in tokens:
+        if token.value in {Platform.LINUX, Platform.WINDOWS}:
+            if not settings.rules_path:
+                console.error("You can't use aliases without specifying the path in the config")
+                sys.exit(1)
+
+            path = settings.rules_path / token.value
+            break
+
+    return path
+
+
 @scanner.command(name="re-scan")
 async def re_scan(
     traces: Annotated[
@@ -48,7 +62,8 @@ async def re_scan(
         Path | None,
         Parameter(
             name=["--rules", "-r"],
-            help="The path to the folder with the rules or the default rules from the sandbox",
+            help="The path to the folder with the rules or the default rules from the sandbox or platform alias (windows, linux)",
+            converter=rules_path_resolver,
         ),
     ] = None,
     out_dir: Annotated[
@@ -136,7 +151,8 @@ async def scan(
         Path | None,
         Parameter(
             name=["--rules", "-r"],
-            help="The path to the folder with the rules or the default rules from the sandbox",
+            help="The path to the folder with the rules or the default rules from the sandbox or platform alias (windows, linux)",
+            converter=rules_path_resolver,
         ),
     ] = None,
     out_dir: Annotated[
@@ -372,7 +388,8 @@ async def scan_new(
         Path | None,
         Parameter(
             name=["--rules", "-r"],
-            help="The path to the folder with the rules or the default rules from the sandbox",
+            help="The path to the folder with the rules or the default rules from the sandbox or platform alias (windows, linux)",
+            converter=rules_path_resolver,
         ),
     ] = None,
     out_dir: Annotated[

{sandbox_cli-0.2.26 → sandbox_cli-0.2.28}/sandbox_cli/console.py

@@ -21,4 +21,3 @@ class SandboxConsole(Console):
 
 
 console = SandboxConsole(color_system="auto", emoji=True)
-console = SandboxConsole(color_system="auto", emoji=True)

{sandbox_cli-0.2.26 → sandbox_cli-0.2.28}/sandbox_cli/internal/config.py

@@ -44,6 +44,11 @@ class VMImage(str, Enum):
         return str(self.value)
 
 
+class Platform(str, Enum):
+    LINUX = "linux"
+    WINDOWS = "windows"
+
+
 class Settings(BaseModel):
     class Docker(BaseModel):
         username: str = ""
@@ -113,9 +118,11 @@ class Settings(BaseModel):
     passwords: list[str] = ["infected", "311138", "password", "12345678", "P@ssw0rd!"]
     docker: Docker = Docker()
     sandbox: list[Sandbox] = []
+    rules_path: Path | None = Field(default=None, alias="rules-path")
 
     def model_post_init(self, __context: Any) -> None:
         self.sandbox_keys = [x.sandbox_key for x in self.sandbox]
+        self.rules_path = Path(self.rules_path) if self.rules_path else None
 
 
 def load_config(path: Path) -> Settings:

{sandbox_cli-0.2.26 → sandbox_cli-0.2.28}/sandbox_cli/utils/downloader/__init__.py

@@ -25,6 +25,7 @@ semaphore = asyncio.Semaphore(value=12)
 async def _save_artifact(
     scan_id: UUID,
     sandbox: Sandbox,
+    out_dir: Path,
     path: Path,
     file_uri: str,
     decompress: bool = False,
@@ -38,7 +39,7 @@ async def _save_artifact(
         return
 
     # sanitize path
-    path = Path(str(path).replace(" ", "_"))
+    path = out_dir / Path(str(path).replace(" ", "_"))
     task_id: TaskID = None  # type: ignore
 
     async with semaphore:
@@ -100,11 +101,12 @@ async def download(
 ) -> None:
     tasks: list[Coroutine[Any, Any, None]] = []
 
-    def add_task(path: Path, file_uri: str, decompress: bool = False) -> None:
+    def add_task(out_dir: Path, path: Path, file_uri: str, decompress: bool = False) -> None:
         tasks.append(
             _save_artifact(
                 scan_id=report.scan_id,
                 sandbox=sandbox,
+                out_dir=out_dir,
                 path=path,
                 file_uri=file_uri,
                 progress=progress,
@@ -134,16 +136,16 @@ async def download(
                 LogType.EVENT_RAW,
                 LogType.NETWORK,
             }:
-                add_task(out_dir / log.file_name, log.file_uri)
+                add_task(out_dir, log.file_name, log.file_uri)
 
             if (all or video) and log.type == LogType.SCREENSHOT:
-                add_task(out_dir / log.file_name, log.file_uri)
+                add_task(out_dir, log.file_name, log.file_uri)
 
             if (all or crashdumps) and log.file_name in {"crashdump.bin", "crashdump.metadata"}:
-                add_task(out_dir / "crashdumps" / log.file_name, log.file_uri)
+                add_task(out_dir / "crashdumps", log.file_name, log.file_uri)
 
             if (all or debug) and log.type in {LogType.DEBUG, LogType.GRAPH}:
-                add_task(out_dir / "debug" / log.file_name, log.file_uri)
+                add_task(out_dir / "debug", log.file_name, log.file_uri)
 
         if artifacts or files or procdumps or all:
             if not sandbox_result.details:
@@ -161,14 +163,14 @@ async def download(
 
                 if artifact.type == ArtifactType.FILE and (files or artifacts or all):
                     add_task(
-                        out_dir / "artifacts" / artifact.file_info.file_path.removeprefix("/"),
+                        out_dir / "artifacts",
+                        artifact.file_info.file_path.removeprefix("/"),
                         artifact.file_info.file_uri,
                     )
                 if artifact.type == ArtifactType.PROCESS_DUMP and (procdumps or artifacts or all):
                     add_task(
-                        out_dir
-                        / "process_dump"
-                        / artifact.file_info.details.process_dump.process_name.removeprefix("/"),  # type: ignore
+                        out_dir / "process_dump",
+                        artifact.file_info.details.process_dump.process_name.removeprefix("/"),  # type: ignore
                         artifact.file_info.file_uri,
                         decompress=decompress,
                     )

{sandbox_cli-0.2.26 → sandbox_cli-0.2.28}/sandbox_cli/utils/scanner/rescan.py

@@ -202,7 +202,7 @@ async def rescan_internal(
                 drakvuf_trace = trace / "drakvuf-trace.log.zst"
                 if not drakvuf_trace.exists():
                     console.error(
-                        f"drakvuf-trace.log.gz or drakvuf-trace.log.zst doesn't exists in {trace.expanduser().resolve()}"
+                        f"drakvuf-trace.log.gz or drakvuf-trace.log.zst doesn't exist in {trace.expanduser().resolve()}"
                     )
                     sys.exit(1)