Python FlagFramework.query_type方法代码示例

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import query_type [as 别名]
    def navbar(self,query=None,next=None,previous=None,pageno=None):
        """ Returns the HTML for the navigation bar. """
        if query==None: query=FlagFramework.query_type(())
        
        if not query.has_key('family'):
            query['family']=''
            
        if next:
            #Make a link
            q=query.clone()
            q.FillQueryTarget(next)
            next = '<a href="f?%s"><img height=25 src="/images/forward.png" border="0"></a>' % (str(q))
        else:
            next = '<img src="/images/arrow_right_grey.gif" height=25 border="0">'

        if previous<0:
            previous =  '<img src="/images/arrow_left_grey.gif" height=25 border="0">'
        else:
            q=query.clone()
            q.FillQueryTarget(previous)
            previous = '<a href="f?%s"><img height=25 src="/images/back.png"  border="0"></a>' %  (str(q))

        bar = {'family': Theme.propegate(query,FlagFramework.query_type()),'back': previous,'case': query['case'],'pageno':  pageno,'next': next,'reset': str(query)+'&reset=1','stop': str(query)+'&stop=1'}

        toolbar = '''<table><tr>
        <td valign="bottom"><a href="%(family)s"><img height=25 src="/images/home_grey.png" border="0"></a></td><td valign="bottom">%(back)s</td><td>%(case)s - page %(pageno)s</td><td valign="bottom">%(next)s</td> <td valign="bottom">
        <td valign="bottom"><a href="flag?%(reset)s"><img height=25 src="/images/reset_grey.png" border="0"></a></td></tr></table>''' % bar

        return toolbar

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import query_type [as 别名]
 def display(self, query, result):
     result.heading("Uploaded FS Image from IO Source %s to case %s" % (query["iosource"], query["case"]))
     result.link(
         "Analyse this data",
         FlagFramework.query_type((), case=query["case"], family="Disk Forensics", report="BrowseFS"),
     )
     result.refresh(0, FlagFramework.query_type((), case=query["case"], family="Disk Forensics", report="BrowseFS"))

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import query_type [as 别名]
    def test01types(self):
        query = FlagFramework.query_type(family='Disk Forensics', report='Browse Types',
                                         case=self.test_case)
        self.gui_test(query)

        query = FlagFramework.query_type(family='Network Forensics', report='Browse HTTP Requests',
                                         case=self.test_case)
        self.gui_test(query)

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import query_type [as 别名]
    def display(self,query,result):
        dbh = self.DBO(query['case'])
        graph = GraphViz(query['prog'],result)

        ##What conditions did the user ask to see?
        conditions = "description='%s'" % "' or description='".join(query.getarray('deductions'))

        ## If the user didnt ask to see disconnected nodes, we create a temporary knowledge table, else we use the original table
        if query.has_key('show_disc'):
            knowledge = 'knowledge'
        else:
            knowledge = dbh.get_temp()
            ## This gives us those nodes that appear in transitive links meeting the conditions
            dbh.execute("create table %s select * from knowledge as a where a.link='transitive' and (%s)",(knowledge,conditions))

        def find_root_node(name,type):
            """ Follows node named by name up the kb tree to find the node denoted by type

            @arg name: Name of node to start searching from
            @arg type: When a node of this type is found it is returned.
            @return: A node of the given type which is up the tree from the named node
            """
            dbh2 = self.DBO(query['case'])
            while 1:
                dbh2.execute('select type from knowledge_node where name = %r',name)
                rs = dbh2.fetch()
                if rs['type'] == type: return name
                dbh2.execute('select pname from knowledge where name = %r and link="no"' ,(name))
                rs = dbh2.fetch()
                if not rs: return None
                name = rs['pname']

        ## We follow each node up the tree to reach the root as defined by query['type']
        dbh.execute('select a.name,a.pname,description from %s as a,knowledge_node as b where a.name=b.name and a.link="transitive"',knowledge)
        for row in dbh:
            from_node = find_root_node(row['pname'],query['type'])
            to_node = find_root_node(row['name'],query['type'])

            new_query = FlagFramework.query_type((),
                                                 family=query['family'],
                                                 report='DisplayObject',
                                                 object_name=from_node,
                                                 case=query['case']
                                                 )
            graph.node(from_node,label=from_node,URL="f?%s" % new_query)

            new_query = FlagFramework.query_type((),
                                                 family=query['family'],
                                                 report='DisplayObject',
                                                 object_name=to_node,
                                                 case=query['case']
                                                 )
            graph.node(to_node,label=to_node,URL="f?%s" % new_query)
            graph.edge(from_node,to_node,label=row['description'])
            
        graph.draw()

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import query_type [as 别名]
    def parse(self,args):
        """ This method parses the args storing the option args in self.opts and non-option args in self.args.

        Note that we expect to have self.optlist as the getopt string for this command.
        """
        opts,self.args=getopt.gnu_getopt(args,self.optlist,self.long_opts)
        self.opts=FlagFramework.query_type(opts)

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import query_type [as 别名]
    def plain_display_hook(self, value, row, result):
        offset, inode = value.split(",")
        offset = int(offset)

        ## The target Inode is the inode we are operating on:
        inodes = inode.split("|")
        last_inode = "|".join(inodes[:-1])

        ## Note that the offset is in virtual address space, we want
        ## to send the user back to the image (physical address space)
        ## so we need to convert here:
        v = get_vol_object(self.case, last_inode[1:])

        ## Physical offset:
        phy_offset = v.addr_space.vtop(offset)
        
        target = FlagFramework.query_type(family="Disk Forensics",
                                          report="ViewFile",
                                          offset=phy_offset,
                                          inode=last_inode,
                                          case=self.case,
                                          memory=last_inode[1:],
                                          mode="HexDump")
        
        result.link("0x%08X" % offset, target=target, pane='new')

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import query_type [as 别名]
def geoip_display_hook(self, value, row, result):
        ## We try to show a whois if possible
        id = lookup_whois(value)
        tmp2 = result.__class__(result)
        tmp3 = result.__class__(result)

        if config.WHOIS_DISPLAY:
            identify_network(id, value, tmp3)

        try:
            if config.GEOIP_DISPLAY:
                geoip_resolve(value,tmp3)
        except AttributeError:
            pass

        try:
            if config.EXTENDED_GEOIP_DISPLAY:
                geoip_resolve_extended(value,tmp3)
        except AttributeError:
            pass

        tmp2.link(tmp3,
                  target=FlagFramework.query_type(family="Log Analysis", 
                                                  report="LookupIP", address=value),
                  pane='popup')

        result.start_table()
        result.row(tmp2)
        result.end_table()

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import query_type [as 别名]
    def stats(self, query,result, merge = None):
        """ Show statistics about the file """
        fsfd = DBFS(query['case'])
        istat = fsfd.istat(inode_id=query['inode_id'])
        left = result.__class__(result)
        link = result.__class__(result)

        link.link(self.urn,
                  FlagFramework.query_type((),family="Disk Forensics",
                      report='BrowseFS',
                      open_tree=self.urn, case=query['case'])
                  )
        left.row("Filename:",'',link)
        if merge:
            istat.update(merge)
            
        try:
            for k,values in istat.items():
                for v in values:
                    left.row('%s:' % k,'',v, align='left')
        except AttributeError:
            pass

        left.end_table()

        result.start_table(width="100%")
        result.row(left,valign='top',align="left")

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import query_type [as 别名]
    def prepare(self):
        """ Returns a report, query all ready from the current args """
        args=self.args
        query=FlagFramework.query_type(())
 
        try:
            query['family'],query['report']=args[0].split('.')
        except:
            raise RuntimeError("Unable to parse %s as a family.report" % args[0])
        
        report = Registry.REPORTS.dispatch(query['family'],query['report'])
        ## Include the report and family:

        for arg in args[1:]:
            try:
#                del query[arg[:arg.index('=')]]
                query[arg[:arg.index('=')]]=arg[arg.index('=')+1:]
            except ValueError:
                raise RuntimeError("Argument should be of the form key=value, got %s" % arg)

        ## Include environment variables in the query:
        for arg in dir(self.environment):
            if not arg.startswith('_') and not query.has_key(arg):
                try:
                    query[arg]=self.environment.__dict__[arg]
                except KeyError:
                    pass

#        if not query.has_key('case'): query['case']=config.FLAGDB
        return report,query

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import query_type [as 别名]
    def menu(self,flag,query, result):
        """ Draws the menu for the current family.

        @arg flag: A Flag object containing the appropriate dispatcher
        @arg query: The user query
        """
        family = query['family']
        family_block = flag.ui()
        family_block.start_table()

        module_list = Registry.REPORTS.get_families()
        order_families(module_list)
        
        for m in module_list:
            link = flag.ui()
            link.link(m,family=m)
            family_block.row(link)
            
        report_block = flag.ui()
        if family and family != 'None':
            report_block.start_table()
            report_list = Registry.REPORTS.family[family]
            for r in report_list:
                if r.hidden: continue
                link = flag.ui()
                link.link(r.name,target=propegate(query,FlagFramework.query_type()),report=r.name,tooltip=r.__doc__)

                report_block.row(link,colspan=2)
                report_block.row(" ",r.description)

        result = flag.ui()
        result.heading("Flag Main Menu")
        result.start_table()
        result.row(family_block,report_block,valign="top")
        return result

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import query_type [as 别名]
    def CaseTableTests(self, tablename):
        ## Apply each column's test filters:
        t = Registry.CASE_TABLES.dispatch(tablename)()
        result = HTMLUI.HTMLUI(initial=True)
        dbh=DB.DBO(self.test_case)
        ## For each column run all its test cases:
        elements = [ c for c in t.bind_columns(self.test_case) ]

        ## Create a renderer:
        r = UI.TableRenderer(elements = elements, table = tablename)
        
        for c in elements:
            for operator, arg, e in c.tests:
                try:
                    ## Get the SQL:
                    r.filter_str = "'%s' %s '%s'" % (c.name, operator, arg)
                    query = FlagFramework.query_type(direction=1)
                    sql = r._make_sql(query)
                    
                    print "%s: Testing %s: %s" % (tablename,
                                                  c.__class__,
                                                  r.filter_str)
                    
                    dbh.execute(sql + " limit 1")
                    dbh.fetch()
                except Exception:
                    if not e: raise
                    continue
                
                if e:
                    raise Exception("Expected an exception but did not receive one on filter string %s. SQL was %s" %( r.filter_str,sql))

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import query_type [as 别名]
    def display(self, value, row, result):
        dbh = DB.DBO(self.case)
        fsfd = FileSystem.DBFS(self.case)
        dbh.execute("select file.inode_id as inode_id, name from file, webmail_attachments where webmail_attachments.inode_id = %r and file.inode_id = webmail_attachments.attachment", value)
        for row in dbh:
            tmp = result.__class__(result)

            try:
                fd = fsfd.open(inode_id=row['inode_id'])
                image = Graph.Thumbnailer(fd,100)
            except IOError:
                pass
            
            if image.height>0:
                tmp.image(image,width=image.width,height=image.height)
            else:
                tmp.image(image,width=image.width)

            link = result.__class__(result)
            name = row['name']
            if len(name) > 20: name = name[:20]+" ..."
            tmp.para(name)
            link.link(tmp, tooltip = row['name'],
                      pane = 'new',
                      target= FlagFramework.query_type(family = "Disk Forensics",
                                                       report = "ViewFile",
                                                       case = self.case,
                                                       mode = 'Summary',
                                                       inode_id = row['inode_id']))
            result.row(link)

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import query_type [as 别名]
    def link(self,string,target=None,options=None,icon=None,tooltip='',pane='main', **target_options):
        """ The user can specify which pane the link will open in by using the pane variable:

        pane can be:

        main (default): refresh to the main pane (default).
        parent: refresh to the pane that contains this pane. (useful for popups etc).
        popup: open a new popup window and draw the target in that.
        self: refresh to the current pane (useful for internal links in popups etc).
        """
        ## If the user specified a URL, we just use it as is:
        try:
            self.result+="<a href='%s'>%s</a>" % (target_options['url'],string)
            return
        except KeyError:
            pass

        ## The target query can over ride the pane specification
        try:
            pane = target['__targetpane__']
            del target['__targetpane__']
        except:
            pass
        
        if target==None:
            target=FlagFramework.query_type(())

        if not options:
            options={}
            
        q=target.clone()
        if target_options:
            for k,v in target_options.items():
                del q[k]
                q[k]=v

        pane = self._calculate_js_for_pane("Link%s" % self.id, target=q, pane=pane)

        if icon:
            tmp = self.__class__(self)
            tmp.icon(icon,tooltip=string+tooltip,border=0)
            string=tmp

        if pane=='popup':
            def popup_cb(query, result):
                self.refresh(0, target)
                
            self.popup(popup_cb, string, icon=icon, tooltip=tooltip)
            return
        
        else:
            ## This has a valid href so that it is possible to right
            ## click and open in new tab or save the link in a normal
            ## bookmark
            base = '<a %s id="Link%s" onclick="update_container(%s, \'/f?%s\'); return false;" href="/f?%s&__pane__=main">%s</a>' % (self.opt_to_str(options),self.id, pane, q, q,  string)
            if tooltip:
                self.tooltip("Link%s" % self.id, tooltip)

        self.result+=base

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import query_type [as 别名]
    def render(self, query=FlagFramework.query_type(()), meta='',data='',next=None,previous=None,pageno=None,ui=None):
        toolbar=self.navbar(query=query , next=next , previous=previous , pageno=pageno)
        try:
            toolbar_str=ui.toolbar_ui.__str__()
        except:
            toolbar_str=''

        return " ".join((self.header,self.banner,meta,"<td align=left>%s</td><td align=center>"%toolbar_str,toolbar,'''</td><td width=10><center><img src="images/logo.png"><br><font size="+1"><a href="http://www.gnu.org/copyleft/gpl.html"> &copy;GPL</a></font></center></td></tr></tbody></table> </tr></table>\n''', data ,"<table width=100%%><tr><td></td></tr><tr><td align=center>%s</td></tr></table>"%(toolbar),self.footer))

# 需要导入模块: from pyflag import FlagFramework [as 别名]
# 或者: from pyflag.FlagFramework import query_type [as 别名]
 def link_display_hook(self, value, row, result):
     q = FlagFramework.query_type(report='SQLite',
                                  family='Disk Forensics',
                                  inode_id = row['Inode'],
                                  case = self.case,
                                  table_name = value)
     result.clear()
     result.link(value, q,pane='new')