<commit_before>/*
 * Autopsy Forensic Browser
 * 
 * Copyright 2013 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 * 
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *     http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.modules.stix;

import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.TskCoreException;

import java.util.List;
import java.util.ArrayList;
import java.util.Date;
import java.util.TimeZone;
import java.text.ParseException;
import java.text.SimpleDateFormat;
import org.mitre.cybox.common_2.ConditionApplicationEnum;

import org.mitre.cybox.objects.FileObjectType;
import org.mitre.cybox.objects.WindowsExecutableFileObjectType;
import org.mitre.cybox.common_2.ConditionTypeEnum;
import org.mitre.cybox.common_2.DatatypeEnum;
import org.mitre.cybox.common_2.HashType;
import org.mitre.cybox.common_2.DateTimeObjectPropertyType;
import org.mitre.cybox.common_2.StringObjectPropertyType;
import org.mitre.cybox.common_2.UnsignedLongObjectPropertyType;

/**
 *
 */
class EvalFileObj extends EvaluatableObject {

    private final FileObjectType obj;

    public EvalFileObj(FileObjectType a_obj, String a_id, String a_spacing) {
        obj = a_obj;
        id = a_id;
        spacing = a_spacing;
    }

    @Override
    public synchronized ObservableResult evaluate() {

        Case case1 = Case.getCurrentCase();
        SleuthkitCase sleuthkitCase = case1.getSleuthkitCase();

        setWarnings("");
        String whereClause = "";

        if (obj.getSizeInBytes() != null) {
            try {
                String newClause = processULongObject(obj.getSizeInBytes(), "size"); //NON-NLS
                whereClause = addClause(whereClause, newClause);
            } catch (TskCoreException ex) {
                addWarning(ex.getLocalizedMessage());
            }
        }

        if (obj.getFileName() != null) {
            try {
                String newClause = processStringObject(obj.getFileName(), "name"); //NON-NLS
                whereClause = addClause(whereClause, newClause);
            } catch (TskCoreException ex) {
                addWarning(ex.getLocalizedMessage());
            }
        }

        if (obj.getFileExtension() != null) {
            if ((obj.getFileExtension().getCondition() == null)
                    || (obj.getFileExtension().getCondition() == ConditionTypeEnum.EQUALS)) {
                String newClause = "name LIKE \'%" + obj.getFileExtension().getValue() + "\'"; //NON-NLS
                whereClause = addClause(whereClause, newClause);
            } else {
                addWarning(
                        "Could not process condition " + obj.getFileExtension().getCondition().value() + " on file extension"); //NON-NLS
            }
        }

        if (obj.getFilePath() != null) {
            try {

                String[] parts = obj.getFilePath().getValue().toString().split("##comma##"); //NON-NLS
                String finalPathStr = "";

                for (String filePath : parts) {
                    // First, we need to normalize the path
                    String currentFilePath = filePath;

                    // Remove the drive letter
                    if (currentFilePath.matches("^[A-Za-z]:.*")) {
                        currentFilePath = currentFilePath.substring(2);
                    }

                    // Change any backslashes to forward slashes
                    currentFilePath = currentFilePath.replace("\\", "/");

                    // The path needs to start with a slash
                    if (!currentFilePath.startsWith("/")) {
                        currentFilePath = "/" + currentFilePath;
                    }

                    // If the path does not end in a slash, the final part should be the file name.
                    if (!currentFilePath.endsWith("/")) {
                        int lastSlash = currentFilePath.lastIndexOf('/');
                        if (lastSlash >= 0) {
                            currentFilePath = currentFilePath.substring(0, lastSlash + 1);
                        }
                    }

                    // Reconstruct the path string (which may be multi-part)
                    if (!finalPathStr.isEmpty()) {
                        finalPathStr += "##comma##"; //NON-NLS
                    }
                    finalPathStr += currentFilePath;
                }

                String newClause = processStringObject(finalPathStr, obj.getFilePath().getCondition(),
                        obj.getFilePath().getApplyCondition(), "parent_path"); //NON-NLS

                whereClause = addClause(whereClause, newClause);
            } catch (TskCoreException ex) {
                addWarning(ex.getLocalizedMessage());
            }
        }

        if (obj.getCreatedTime() != null) {
            try {
                String newClause = processTimestampObject(obj.getCreatedTime(), "crtime"); //NON-NLS
                whereClause = addClause(whereClause, newClause);
            } catch (TskCoreException ex) {
                addWarning(ex.getLocalizedMessage());
            }
        }

        if (obj.getModifiedTime() != null) {
            try {
                String newClause = processTimestampObject(obj.getModifiedTime(), "mtime"); //NON-NLS
                whereClause = addClause(whereClause, newClause);
            } catch (TskCoreException ex) {
                addWarning(ex.getLocalizedMessage());
            }
        }

        if (obj.getAccessedTime() != null) {
            try {
                String newClause = processTimestampObject(obj.getAccessedTime(), "atime"); //NON-NLS
                whereClause = addClause(whereClause, newClause);
            } catch (TskCoreException ex) {
                addWarning(ex.getLocalizedMessage());
            }
        }

        if (obj.getHashes() != null) {
            for (HashType h : obj.getHashes().getHashes()) {
                if (h.getSimpleHashValue() != null) {
                    if (h.getType().getValue().equals("MD5")) { //NON-NLS
                        String newClause = "md5=\'" + h.getSimpleHashValue().getValue() + "\'"; //NON-NLS
                        whereClause = addClause(whereClause, newClause);
                    } else {
                        addWarning("Could not process hash type " + h.getType().getValue().toString()); //NON-NLS
                    }
                } else {<commit_msg>Convert MD5 hash to lowercase before database query.<commit_after>/*
 * Autopsy Forensic Browser
 * 
 * Copyright 2013 Basis Technology Corp.
 * Contact: carrier <at> sleuthkit <dot> org
 * 
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *     http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.sleuthkit.autopsy.modules.stix;

import org.sleuthkit.autopsy.casemodule.Case;
import org.sleuthkit.datamodel.SleuthkitCase;
import org.sleuthkit.datamodel.AbstractFile;
import org.sleuthkit.datamodel.BlackboardArtifact;
import org.sleuthkit.datamodel.BlackboardAttribute;
import org.sleuthkit.datamodel.TskCoreException;

import java.util.List;
import java.util.ArrayList;
import java.util.Date;
import java.util.TimeZone;
import java.text.ParseException;
import java.text.SimpleDateFormat;
import org.mitre.cybox.common_2.ConditionApplicationEnum;

import org.mitre.cybox.objects.FileObjectType;
import org.mitre.cybox.objects.WindowsExecutableFileObjectType;
import org.mitre.cybox.common_2.ConditionTypeEnum;
import org.mitre.cybox.common_2.DatatypeEnum;
import org.mitre.cybox.common_2.HashType;
import org.mitre.cybox.common_2.DateTimeObjectPropertyType;
import org.mitre.cybox.common_2.StringObjectPropertyType;
import org.mitre.cybox.common_2.UnsignedLongObjectPropertyType;

/**
 *
 */
class EvalFileObj extends EvaluatableObject {

    private final FileObjectType obj;

    public EvalFileObj(FileObjectType a_obj, String a_id, String a_spacing) {
        obj = a_obj;
        id = a_id;
        spacing = a_spacing;
    }

    @Override
    public synchronized ObservableResult evaluate() {

        Case case1 = Case.getCurrentCase();
        SleuthkitCase sleuthkitCase = case1.getSleuthkitCase();

        setWarnings("");
        String whereClause = "";

        if (obj.getSizeInBytes() != null) {
            try {
                String newClause = processULongObject(obj.getSizeInBytes(), "size"); //NON-NLS
                whereClause = addClause(whereClause, newClause);
            } catch (TskCoreException ex) {
                addWarning(ex.getLocalizedMessage());
            }
        }

        if (obj.getFileName() != null) {
            try {
                String newClause = processStringObject(obj.getFileName(), "name"); //NON-NLS
                whereClause = addClause(whereClause, newClause);
            } catch (TskCoreException ex) {
                addWarning(ex.getLocalizedMessage());
            }
        }

        if (obj.getFileExtension() != null) {
            if ((obj.getFileExtension().getCondition() == null)
                    || (obj.getFileExtension().getCondition() == ConditionTypeEnum.EQUALS)) {
                String newClause = "name LIKE \'%" + obj.getFileExtension().getValue() + "\'"; //NON-NLS
                whereClause = addClause(whereClause, newClause);
            } else {
                addWarning(
                        "Could not process condition " + obj.getFileExtension().getCondition().value() + " on file extension"); //NON-NLS
            }
        }

        if (obj.getFilePath() != null) {
            try {

                String[] parts = obj.getFilePath().getValue().toString().split("##comma##"); //NON-NLS
                String finalPathStr = "";

                for (String filePath : parts) {
                    // First, we need to normalize the path
                    String currentFilePath = filePath;

                    // Remove the drive letter
                    if (currentFilePath.matches("^[A-Za-z]:.*")) {
                        currentFilePath = currentFilePath.substring(2);
                    }

                    // Change any backslashes to forward slashes
                    currentFilePath = currentFilePath.replace("\\", "/");

                    // The path needs to start with a slash
                    if (!currentFilePath.startsWith("/")) {
                        currentFilePath = "/" + currentFilePath;
                    }

                    // If the path does not end in a slash, the final part should be the file name.
                    if (!currentFilePath.endsWith("/")) {
                        int lastSlash = currentFilePath.lastIndexOf('/');
                        if (lastSlash >= 0) {
                            currentFilePath = currentFilePath.substring(0, lastSlash + 1);
                        }
                    }

                    // Reconstruct the path string (which may be multi-part)
                    if (!finalPathStr.isEmpty()) {
                        finalPathStr += "##comma##"; //NON-NLS
                    }
                    finalPathStr += currentFilePath;
                }

                String newClause = processStringObject(finalPathStr, obj.getFilePath().getCondition(),
                        obj.getFilePath().getApplyCondition(), "parent_path"); //NON-NLS

                whereClause = addClause(whereClause, newClause);
            } catch (TskCoreException ex) {
                addWarning(ex.getLocalizedMessage());
            }
        }

        if (obj.getCreatedTime() != null) {
            try {
                String newClause = processTimestampObject(obj.getCreatedTime(), "crtime"); //NON-NLS
                whereClause = addClause(whereClause, newClause);
            } catch (TskCoreException ex) {
                addWarning(ex.getLocalizedMessage());
            }
        }

        if (obj.getModifiedTime() != null) {
            try {
                String newClause = processTimestampObject(obj.getModifiedTime(), "mtime"); //NON-NLS
                whereClause = addClause(whereClause, newClause);
            } catch (TskCoreException ex) {
                addWarning(ex.getLocalizedMessage());
            }
        }

        if (obj.getAccessedTime() != null) {
            try {
                String newClause = processTimestampObject(obj.getAccessedTime(), "atime"); //NON-NLS
                whereClause = addClause(whereClause, newClause);
            } catch (TskCoreException ex) {
                addWarning(ex.getLocalizedMessage());
            }
        }

        if (obj.getHashes() != null) {
            for (HashType h : obj.getHashes().getHashes()) {
                if (h.getSimpleHashValue() != null) {
                    if (h.getType().getValue().equals("MD5")) { //NON-NLS
                        String newClause = "md5=\'" + h.getSimpleHashValue().getValue().toString().toLowerCase() + "\'"; //NON-NLS
                        whereClause = addClause(whereClause, newClause);
                    } else {
                        addWarning("Could not process hash type " + h.getType().getValue().toString()); //NON-NLS
                    }
                } else {
{'fraction_non_alphanumeric': 0.10855906171460486, 'fraction_numerical': 0.00328120636693661, 'mean_word_length': 1.9192989606684328, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 9, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6200580', 'n_tokens_mistral': 3848, 'n_tokens_neox': 3719, 'n_words': 847}