Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Potential issue with multi volume pre-processing #4781

Open
nflexfo opened this issue Jan 9, 2024 · 1 comment
Open

Potential issue with multi volume pre-processing #4781

nflexfo opened this issue Jan 9, 2024 · 1 comment
Assignees
Labels
needs closer look Issue that requires further analysis by a maintainer

Comments

@nflexfo
Copy link

nflexfo commented Jan 9, 2024

Describe the problem:

Commit fb0a7d4 changed the error handling of preprocessor to only raise an exception when none of the sources were successfully pre-processed. However, the current implementation will actually raise an exception when the last source preprocessing failed:

https://github.com/joachimmetz/plaso/blob/ebe2f69b4903ca8a3da23ac9ad9b233664425d3e/plaso/preprocessors/interface.py#L65

    last_exception = None

    for source in artifact_definition.sources:
      if source.type_indicator not in (
          artifact_definitions.TYPE_INDICATOR_FILE,
          artifact_definitions.TYPE_INDICATOR_PATH):
        continue

      for path in source.paths:
        find_spec = file_system_searcher.FindSpec(
            case_sensitive=False, location_glob=path,
            location_separator=source.separator)

        for path_specification in searcher.Find(find_specs=[find_spec]):
          try:
            self._ParsePathSpecification(
                mediator, searcher, file_system, path_specification,
                source.separator)

            last_exception = None
          except errors.PreProcessFail as exception:
            last_exception = exception

    if last_exception:
      # Only raise an exception if none of the sources were successfully
      # pre-processed.
      raise last_exception

If I'm not mistaken, the fix would be add another variable succeed set to False and mark it True instead of last_exception = None, and then check the success value at the end of the function while raising the last_exception exception.

To Reproduce:

Pre-process two sources where the first source succeed and the second fails.

Affected Version

Any version >= Plaso-20230717.

Expected behavior:

According to commit message, the method should only raise exception if all sources have failed.

Debug output/tracebacks:

N/A

Additional context

N/A

@joachimmetz
Copy link
Member

thanks for flagging I'll have a look when time permits, there is more work to be done on multi volume pre-processing also see #2286

@joachimmetz joachimmetz self-assigned this Jan 9, 2024
@joachimmetz joachimmetz added the needs closer look Issue that requires further analysis by a maintainer label Jan 9, 2024
@joachimmetz joachimmetz changed the title Potential misbehavior in pre-processor error handling Potential issue with multi volume pre-processing Jan 9, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs closer look Issue that requires further analysis by a maintainer
Projects
None yet
Development

No branches or pull requests

2 participants