0x1949 Team - FAZEMRX - MANAGER
Edit File: __init__.cpython-310.pyc
o i��d � @ s d dl Z G dd� d�ZdS )� Nc @ sl e Zd ZdZdZg Zg Zg ZdZdZ i fdd�Z dd� Z d d � Z d d � Z d d� Zdd� Zdd� Zdd� ZdS )�SoSCleanerParsera� Parsers are used to build objects that will take a line as input, parse it for a particular pattern (E.G. IP addresses) and then make any necessary subtitutions by referencing the SoSMap() associated with the parser. Ideally a new parser subclass will only need to set the class level attrs in order to be fully functional. :param conf_file: The configuration file to read from :type conf_file: ``str`` :cvar name: The parser name, used in logging errors :vartype name: ``str`` :cvar regex_patterns: A list of regex patterns to iterate over for every line processed :vartype regex_patterns: ``list`` :cvar mapping: Used by the parser to store and obfuscate matches :vartype mapping: ``SoSMap()`` :cvar map_file_key: The key in the ``map_file`` to read when loading previous obfuscation matches :vartype map_file_key: ``str`` zUndefined Parser�unsetTc C s( | j |v r| j�|| j � | �� d S )N)� map_file_key�mapping� conf_update�_generate_skip_regexes)�self�config� r �>/usr/lib/python3/dist-packages/sos/cleaner/parsers/__init__.py�__init__1 s zSoSCleanerParser.__init__c C s( g | _ | jD ] }| j �t�|�� qdS )z�Generate the regexes for the parser's configured `skip_files`, so that we don't regenerate them on every file being examined for if the parser should skip a given file. N)� skip_patterns� skip_files�append�re�compile)r �pr r r r 6 s �z'SoSCleanerParser._generate_skip_regexesc C s( | j sdS | jjD ]}| j�|� q dS )z�Generate regexes for items the parser will be searching for repeatedly without needing to generate them for every file and/or line we process Not used by all parsers. N)�compile_regexesr �dataset�add_regex_item)r �obitemr r r �generate_item_regexes? s �z&SoSCleanerParser.generate_item_regexesc C sf d}| j D ]}t�||tj�r||f S q| jr$| �|�\}}||7 }| �|�\}}||7 }||fS )a� This will be called for every line in every file we process, so that every parser has a chance to scrub everything. This will first try to identify needed obfuscations for items we have already encountered (if the parser uses compiled regexes that is) and make those substitutions early on. After which, we will then parse the line again looking for new matches. r )�skip_line_patternsr �match�Ir �!_parse_line_with_compiled_regexes� _parse_line)r �line�count� skip_pattern�_rcount�_countr r r � parse_lineK s �zSoSCleanerParser.parse_linec C sL d}| j jD ]\}}|�|�r!|�| j �|�� �|�\}}||7 }q||fS )ah Check the provided line against known items we have encountered before and have pre-generated regex Pattern() objects for. :param line: The line to parse for possible matches for obfuscation :type line: ``str`` :returns: The obfuscated line and the number of changes made :rtype: ``str``, ``int`` r )r �compiled_regexes�search�subn�get�lower)r r r �item�regr! r r r r _ s �z2SoSCleanerParser._parse_line_with_compiled_regexesc C s� d}| j D ]@}dd� t�||tj�D �}|rE|jdtd� |t|�7 }|D ] }|�� }|| jj� � v r4q%| j� |�}||krD|� ||�}q%q||fS )aR Check the provided line against the parser regex patterns to try and discover _new_ items to obfuscate :param line: The line to parse for possible matches for obfuscation :type line: ``str`` :returns: The obfsucated line, and the number of changes made :rtype: ``tuple``, ``(str, int))`` r c S s g | ]}|d �qS )r r )�.0�mr r r � <listcomp>| s z0SoSCleanerParser._parse_line.<locals>.<listcomp>T��reverse�key) �regex_patternsr �findallr �sort�len�stripr r �valuesr& �replace)r r r �pattern�matchesr � new_matchr r r r p s �z SoSCleanerParser._parse_linec C s� | j r | jjD ]\}}|�|�r|�| j�|�|�}q|S t| jj�� ddd� d�D ]\}}|| jj v r5q*||v r?|� ||�}q*|S )a� Parse a given string for instances of any obfuscated items, without applying the normal regex comparisons first. This is mainly used to obfuscate filenames that have, for example, hostnames in them. Rather than try to regex match the string_data, just use the builtin checks for substrings matching known obfuscated keys :param string_data: The line to be parsed :type string_data: ``str`` :returns: The obfuscated line :rtype: ``str`` Tc S s t | d �S )Nr )r3 )�xr r r �<lambda>� s z8SoSCleanerParser.parse_string_for_keys.<locals>.<lambda>r- ) r r r# r$ �subr& �sortedr �items� skip_keysr6 )r � string_datar( r) �k�obr r r �parse_string_for_keys� s ��� �z&SoSCleanerParser.parse_string_for_keysc C s | j jS )z�Get the contents of the mapping used by the parser :returns: All matches and their obfuscate counterparts :rtype: ``dict`` )r r )r r r r �get_map_contents� s z!SoSCleanerParser.get_map_contentsN)�__name__� __module__� __qualname__�__doc__�namer0 r r r r r r r r" r r rC rD r r r r r s r )r r r r r r �<module> s