go format
This commit is contained in:
parent
4ee3a0be1a
commit
cc8246c222
18 changed files with 207 additions and 217 deletions
|
@ -45,16 +45,16 @@ func setDefaults() {
|
||||||
viper.SetDefault("db.debug", false)
|
viper.SetDefault("db.debug", false)
|
||||||
// Others
|
// Others
|
||||||
viper.SetDefault("processing.oleurl", "http://localhost:5000")
|
viper.SetDefault("processing.oleurl", "http://localhost:5000")
|
||||||
viper.SetDefault("processing.maxmimesize", "100MB")
|
viper.SetDefault("processing.maxmimesize", "100MB")
|
||||||
viper.SetDefault("processing.yararules", "./storage/rules")
|
viper.SetDefault("processing.yararules", "./storage/rules")
|
||||||
viper.SetDefault("processing.yaracompiled", "./storage/output.yarc")
|
viper.SetDefault("processing.yaracompiled", "./storage/output.yarc")
|
||||||
viper.SetDefault("store.path", "./storage/files")
|
viper.SetDefault("store.path", "./storage/files")
|
||||||
viper.SetDefault("debug", false)
|
viper.SetDefault("debug", false)
|
||||||
// UI Interface info
|
// UI Interface info
|
||||||
viper.SetDefault("ui.name", "Scanfile")
|
viper.SetDefault("ui.name", "Scanfile")
|
||||||
viper.SetDefault("ui.byurl", "https://www.jmbit.de")
|
viper.SetDefault("ui.byurl", "https://www.jmbit.de")
|
||||||
viper.SetDefault("ui.byurl", "Johannes Bülow")
|
viper.SetDefault("ui.byurl", "Johannes Bülow")
|
||||||
viper.SetDefault("ui.source", "https://git.jmbit.de/jmb/scanfile")
|
viper.SetDefault("ui.source", "https://git.jmbit.de/jmb/scanfile")
|
||||||
}
|
}
|
||||||
|
|
||||||
func SaveConfig() error {
|
func SaveConfig() error {
|
||||||
|
|
|
@ -60,23 +60,22 @@ func GetFileMime(fileID pgtype.UUID) (string, error) {
|
||||||
}
|
}
|
||||||
|
|
||||||
func GetFileProperties(fileID pgtype.UUID) (sqlc.FileProperty, error) {
|
func GetFileProperties(fileID pgtype.UUID) (sqlc.FileProperty, error) {
|
||||||
query := sqlc.New(pool)
|
query := sqlc.New(pool)
|
||||||
fileProperties, err := query.GetFileProperties(context.Background(), fileID)
|
fileProperties, err := query.GetFileProperties(context.Background(), fileID)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error in GetFileProperties", "file-uuid", fileID, "error", err)
|
slog.Error("Error in GetFileProperties", "file-uuid", fileID, "error", err)
|
||||||
}
|
}
|
||||||
return fileProperties, err
|
return fileProperties, err
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
func GetAllFiles() ([]sqlc.File, error) {
|
func GetAllFiles() ([]sqlc.File, error) {
|
||||||
query := sqlc.New(pool)
|
query := sqlc.New(pool)
|
||||||
//TODO use actual request context to avoid murdering the DB
|
//TODO use actual request context to avoid murdering the DB
|
||||||
files, err := query.GetAllFiles(context.Background())
|
files, err := query.GetAllFiles(context.Background())
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error in GetAllProperties", "error", err)
|
slog.Error("Error in GetAllProperties", "error", err)
|
||||||
}
|
}
|
||||||
return files, err
|
return files, err
|
||||||
|
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -15,19 +15,19 @@ func GetMSOfficeResults(fileID string) (sqlc.Msoffice, error) {
|
||||||
slog.Error("Unable to convert string to UUID", "file-uuid", fileID, "error", err)
|
slog.Error("Unable to convert string to UUID", "file-uuid", fileID, "error", err)
|
||||||
}
|
}
|
||||||
query := sqlc.New(pool)
|
query := sqlc.New(pool)
|
||||||
data, err := query.GetMSOfficeResults(context.Background(), pgUUID)
|
data, err := query.GetMSOfficeResults(context.Background(), pgUUID)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error in GetMsofficeInfo", "file-uuid", fileID, "error", err)
|
slog.Error("Error in GetMsofficeInfo", "file-uuid", fileID, "error", err)
|
||||||
}
|
}
|
||||||
return data, err
|
return data, err
|
||||||
}
|
}
|
||||||
|
|
||||||
func InsertMSOfficeResults(params sqlc.InsertMSOfficeResultsParams) error {
|
func InsertMSOfficeResults(params sqlc.InsertMSOfficeResultsParams) error {
|
||||||
query := sqlc.New(pool)
|
query := sqlc.New(pool)
|
||||||
slog.Debug("InsertMSOfficeResults", "params", params)
|
slog.Debug("InsertMSOfficeResults", "params", params)
|
||||||
err := query.InsertMSOfficeResults(context.Background(), params)
|
err := query.InsertMSOfficeResults(context.Background(), params)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error in InsertMsofficeInfo", "file-uuid", params.FileID.String(), "error", err)
|
slog.Error("Error in InsertMsofficeInfo", "file-uuid", params.FileID.String(), "error", err)
|
||||||
}
|
}
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
|
@ -73,9 +73,9 @@ func AddProcessingJobMessage(jobid int64, message string) error {
|
||||||
|
|
||||||
func ALlProcessingJobs() ([]sqlc.ProcessingJob, error) {
|
func ALlProcessingJobs() ([]sqlc.ProcessingJob, error) {
|
||||||
query := sqlc.New(pool)
|
query := sqlc.New(pool)
|
||||||
jobs, err := query.GetAllJobs(context.Background())
|
jobs, err := query.GetAllJobs(context.Background())
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Unable to retrieve processing jobs", "error", err)
|
slog.Error("Unable to retrieve processing jobs", "error", err)
|
||||||
}
|
}
|
||||||
return jobs, err
|
return jobs, err
|
||||||
}
|
}
|
||||||
|
|
|
@ -15,19 +15,19 @@ func GetYaraResults(fileID string) (sqlc.YaraResult, error) {
|
||||||
slog.Error("Unable to convert string to UUID", "file-uuid", fileID, "error", err)
|
slog.Error("Unable to convert string to UUID", "file-uuid", fileID, "error", err)
|
||||||
}
|
}
|
||||||
query := sqlc.New(pool)
|
query := sqlc.New(pool)
|
||||||
data, err := query.GetYaraResults(context.Background(), pgUUID)
|
data, err := query.GetYaraResults(context.Background(), pgUUID)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error in GetMsofficeInfo", "file-uuid", fileID, "error", err)
|
slog.Error("Error in GetMsofficeInfo", "file-uuid", fileID, "error", err)
|
||||||
}
|
}
|
||||||
return data, err
|
return data, err
|
||||||
}
|
}
|
||||||
|
|
||||||
func InsertYaraResults(params sqlc.InsertYaraResultsParams) error {
|
func InsertYaraResults(params sqlc.InsertYaraResultsParams) error {
|
||||||
query := sqlc.New(pool)
|
query := sqlc.New(pool)
|
||||||
slog.Debug("InsertYaraResults", "params", params)
|
slog.Debug("InsertYaraResults", "params", params)
|
||||||
_, err := query.InsertYaraResults(context.Background(), params)
|
_, err := query.InsertYaraResults(context.Background(), params)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error in InsertYaraResults", "file-uuid", params.FileID.String(), "error", err)
|
slog.Error("Error in InsertYaraResults", "file-uuid", params.FileID.String(), "error", err)
|
||||||
}
|
}
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
|
@ -12,45 +12,45 @@ func MSOfficeProcessing(job sqlc.ProcessingJob) error {
|
||||||
database.FailProcessingJob(job.ID, err)
|
database.FailProcessingJob(job.ID, err)
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
olevbaResp, err := OleVBAScan(job.FileID)
|
olevbaResp, err := OleVBAScan(job.FileID)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
database.FailProcessingJob(job.ID, err)
|
database.FailProcessingJob(job.ID, err)
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
params := sqlc.InsertMSOfficeResultsParams{
|
params := sqlc.InsertMSOfficeResultsParams{
|
||||||
FileID: job.FileID,
|
FileID: job.FileID,
|
||||||
}
|
}
|
||||||
params.ContainerFormat.String = oleidResp.ContainerFormat
|
params.ContainerFormat.String = oleidResp.ContainerFormat
|
||||||
params.ContainerFormat.Valid = true
|
params.ContainerFormat.Valid = true
|
||||||
params.Encrypted.Bool = oleidResp.Encrypted
|
params.Encrypted.Bool = oleidResp.Encrypted
|
||||||
params.Encrypted.Valid = true
|
params.Encrypted.Valid = true
|
||||||
params.FileFormat.String = oleidResp.FileFormat
|
params.FileFormat.String = oleidResp.FileFormat
|
||||||
params.FileFormat.Valid = true
|
params.FileFormat.Valid = true
|
||||||
params.VbaMacros.String = oleidResp.VBAMacros
|
params.VbaMacros.String = oleidResp.VBAMacros
|
||||||
params.VbaMacros.Valid = true
|
params.VbaMacros.Valid = true
|
||||||
params.XlmMacros.String = oleidResp.XLMMacros
|
params.XlmMacros.String = oleidResp.XLMMacros
|
||||||
params.XlmMacros.Valid = true
|
params.XlmMacros.Valid = true
|
||||||
params.VbaStomping.Bool = olevbaResp.Stomping
|
params.VbaStomping.Bool = olevbaResp.Stomping
|
||||||
params.VbaStomping.Valid = true
|
params.VbaStomping.Valid = true
|
||||||
params.NbAutoexec.Int32 = int32(olevbaResp.NbAutoexec)
|
params.NbAutoexec.Int32 = int32(olevbaResp.NbAutoexec)
|
||||||
params.NbAutoexec.Valid = true
|
params.NbAutoexec.Valid = true
|
||||||
params.NbIocs.Int32 = int32(olevbaResp.NbIocs)
|
params.NbIocs.Int32 = int32(olevbaResp.NbIocs)
|
||||||
params.NbIocs.Valid = true
|
params.NbIocs.Valid = true
|
||||||
params.NbMacros.Int32 = int32(olevbaResp.NbMacros)
|
params.NbMacros.Int32 = int32(olevbaResp.NbMacros)
|
||||||
params.NbIocs.Valid = true
|
params.NbIocs.Valid = true
|
||||||
params.NbSuspicious.Int32 = int32(olevbaResp.NbSuspicious)
|
params.NbSuspicious.Int32 = int32(olevbaResp.NbSuspicious)
|
||||||
params.NbSuspicious.Valid = true
|
params.NbSuspicious.Valid = true
|
||||||
|
|
||||||
params.OlevbaResults = olevbaResp.Results
|
params.OlevbaResults = olevbaResp.Results
|
||||||
params.Macros = olevbaResp.Macros
|
params.Macros = olevbaResp.Macros
|
||||||
if olevbaResp.NbSuspicious > 0 || olevbaResp.NbIocs > 0 || olevbaResp.NbAutoexec > 0 {
|
if olevbaResp.NbSuspicious > 0 || olevbaResp.NbIocs > 0 || olevbaResp.NbAutoexec > 0 {
|
||||||
params.Verdict.String = "suspicious"
|
params.Verdict.String = "suspicious"
|
||||||
} else {
|
} else {
|
||||||
params.Verdict.String = "inconspicous"
|
params.Verdict.String = "inconspicous"
|
||||||
}
|
}
|
||||||
params.Verdict.Valid = true
|
params.Verdict.Valid = true
|
||||||
|
|
||||||
err = database.InsertMSOfficeResults(params)
|
err = database.InsertMSOfficeResults(params)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
database.FailProcessingJob(job.ID, err)
|
database.FailProcessingJob(job.ID, err)
|
||||||
return err
|
return err
|
||||||
|
|
|
@ -31,24 +31,24 @@ func OleIDScan(fileID pgtype.UUID) (oleidResponse, error) {
|
||||||
slog.Error("Error in OleIDScan parsing URL for ole service", "file-uuid", fileID.String(), "error", err)
|
slog.Error("Error in OleIDScan parsing URL for ole service", "file-uuid", fileID.String(), "error", err)
|
||||||
}
|
}
|
||||||
oleidUrl.Path = "/oleid/analyze"
|
oleidUrl.Path = "/oleid/analyze"
|
||||||
oleidUrl.RawQuery = fmt.Sprintf("file=%s", fileID.String())
|
oleidUrl.RawQuery = fmt.Sprintf("file=%s", fileID.String())
|
||||||
oleidResp, err := http.Get(oleidUrl.String())
|
oleidResp, err := http.Get(oleidUrl.String())
|
||||||
slog.Debug("OleIDScan request", "file-uuid", fileID.String(), "url", oleidUrl.String(), "status-code", oleidResp.StatusCode)
|
slog.Debug("OleIDScan request", "file-uuid", fileID.String(), "url", oleidUrl.String(), "status-code", oleidResp.StatusCode)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error in OleIDScan getting oleid info from service", "file-uuid", fileID.String(), "error", err)
|
slog.Error("Error in OleIDScan getting oleid info from service", "file-uuid", fileID.String(), "error", err)
|
||||||
}
|
}
|
||||||
defer oleidResp.Body.Close()
|
defer oleidResp.Body.Close()
|
||||||
body, err := io.ReadAll(oleidResp.Body)
|
body, err := io.ReadAll(oleidResp.Body)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error in OleIDScan parsing oleid body", "file-uuid", fileID.String(), "error", err)
|
slog.Error("Error in OleIDScan parsing oleid body", "file-uuid", fileID.String(), "error", err)
|
||||||
}
|
}
|
||||||
var jsonResponse oleidResponse
|
var jsonResponse oleidResponse
|
||||||
|
|
||||||
err = json.Unmarshal(body, &jsonResponse)
|
err = json.Unmarshal(body, &jsonResponse)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error in OleIDScan when trying to unmarshal response", "file-uuid", fileID.String(), "error", err)
|
slog.Error("Error in OleIDScan when trying to unmarshal response", "file-uuid", fileID.String(), "error", err)
|
||||||
return jsonResponse, err
|
return jsonResponse, err
|
||||||
}
|
}
|
||||||
|
|
||||||
slog.Debug("OleIDScan", "file-uuid", fileID.String(), "data", body)
|
slog.Debug("OleIDScan", "file-uuid", fileID.String(), "data", body)
|
||||||
return jsonResponse, nil
|
return jsonResponse, nil
|
||||||
|
|
|
@ -24,7 +24,6 @@ type olevbaResponse struct {
|
||||||
Stomping bool `json:"stomping"`
|
Stomping bool `json:"stomping"`
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
func OleVBAScan(fileID pgtype.UUID) (olevbaResponse, error) {
|
func OleVBAScan(fileID pgtype.UUID) (olevbaResponse, error) {
|
||||||
slog.Debug("Starting OLEvba scan", "file-uuid", fileID.String())
|
slog.Debug("Starting OLEvba scan", "file-uuid", fileID.String())
|
||||||
oleidUrl, err := url.Parse(viper.GetString("processing.oleurl"))
|
oleidUrl, err := url.Parse(viper.GetString("processing.oleurl"))
|
||||||
|
@ -32,40 +31,40 @@ func OleVBAScan(fileID pgtype.UUID) (olevbaResponse, error) {
|
||||||
slog.Error("Error in OleVBAScan parsing URL for ole service", "file-uuid", fileID.String(), "error", err)
|
slog.Error("Error in OleVBAScan parsing URL for ole service", "file-uuid", fileID.String(), "error", err)
|
||||||
}
|
}
|
||||||
oleidUrl.Path = "/olevba/analyze"
|
oleidUrl.Path = "/olevba/analyze"
|
||||||
oleidUrl.RawQuery = fmt.Sprintf("file=%s", fileID.String())
|
oleidUrl.RawQuery = fmt.Sprintf("file=%s", fileID.String())
|
||||||
oleidResp, err := http.Get(oleidUrl.String())
|
oleidResp, err := http.Get(oleidUrl.String())
|
||||||
slog.Debug("OleVBAScan request", "file-uuid", fileID.String(), "url", oleidUrl.String(), "status-code", oleidResp.StatusCode)
|
slog.Debug("OleVBAScan request", "file-uuid", fileID.String(), "url", oleidUrl.String(), "status-code", oleidResp.StatusCode)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error in OleVBAScan getting olevba info from service", "file-uuid", fileID.String(), "error", err)
|
slog.Error("Error in OleVBAScan getting olevba info from service", "file-uuid", fileID.String(), "error", err)
|
||||||
}
|
}
|
||||||
defer oleidResp.Body.Close()
|
defer oleidResp.Body.Close()
|
||||||
body, err := io.ReadAll(oleidResp.Body)
|
body, err := io.ReadAll(oleidResp.Body)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error in OleVBAScan parsing olevba body", "file-uuid", fileID.String(), "error", err)
|
slog.Error("Error in OleVBAScan parsing olevba body", "file-uuid", fileID.String(), "error", err)
|
||||||
}
|
}
|
||||||
|
|
||||||
var jsonResp olevbaResponse
|
var jsonResp olevbaResponse
|
||||||
|
|
||||||
err = json.Unmarshal(body, &jsonResp)
|
err = json.Unmarshal(body, &jsonResp)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error in OleVBAScan when trying to unmarshal response", "file-uuid", fileID.String(), "error", err)
|
slog.Error("Error in OleVBAScan when trying to unmarshal response", "file-uuid", fileID.String(), "error", err)
|
||||||
return jsonResp, err
|
return jsonResp, err
|
||||||
}
|
}
|
||||||
|
|
||||||
for i, result := range jsonResp.Results {
|
for i, result := range jsonResp.Results {
|
||||||
if result[0] == "Hex String" {
|
if result[0] == "Hex String" {
|
||||||
var hexParts []string
|
var hexParts []string
|
||||||
for _, b := range []byte(result[1]) {
|
for _, b := range []byte(result[1]) {
|
||||||
hexParts = append(hexParts, fmt.Sprintf("0x%X", b))
|
hexParts = append(hexParts, fmt.Sprintf("0x%X", b))
|
||||||
}
|
}
|
||||||
result[1] = strings.Join(hexParts, " ")
|
result[1] = strings.Join(hexParts, " ")
|
||||||
}
|
}
|
||||||
slog.Debug("OleVBAScan Result", "0", result[0], "1", result[1], "2", result[2], "i", i)
|
slog.Debug("OleVBAScan Result", "0", result[0], "1", result[1], "2", result[2], "i", i)
|
||||||
}
|
}
|
||||||
|
|
||||||
for i, macro := range jsonResp.Macros {
|
for i, macro := range jsonResp.Macros {
|
||||||
slog.Debug("OleVBAScan Macro", "0", macro[0], "1", macro[1], "2", macro[2], "3", macro[3], "i", i)
|
slog.Debug("OleVBAScan Macro", "0", macro[0], "1", macro[1], "2", macro[2], "3", macro[3], "i", i)
|
||||||
}
|
}
|
||||||
|
|
||||||
slog.Debug("OleVBAScan", "file-uuid", fileID.String(), "data", jsonResp)
|
slog.Debug("OleVBAScan", "file-uuid", fileID.String(), "data", jsonResp)
|
||||||
return jsonResp, nil
|
return jsonResp, nil
|
||||||
|
|
|
@ -10,17 +10,16 @@ import (
|
||||||
"github.com/spf13/viper"
|
"github.com/spf13/viper"
|
||||||
)
|
)
|
||||||
|
|
||||||
|
|
||||||
func TestOleVba(t *testing.T) {
|
func TestOleVba(t *testing.T) {
|
||||||
slog.SetDefault(slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelDebug})))
|
slog.SetDefault(slog.New(slog.NewTextHandler(os.Stderr, &slog.HandlerOptions{Level: slog.LevelDebug})))
|
||||||
viper.Set("processing.oleurl", "http://localhost:5000")
|
viper.Set("processing.oleurl", "http://localhost:5000")
|
||||||
var fileid pgtype.UUID
|
var fileid pgtype.UUID
|
||||||
fileid.Scan("cf645d68-fc5b-4cba-8940-4ccce437e354")
|
fileid.Scan("cf645d68-fc5b-4cba-8940-4ccce437e354")
|
||||||
t.Log(fileid)
|
t.Log(fileid)
|
||||||
resp, err := msoffice.OleVBAScan(fileid)
|
resp, err := msoffice.OleVBAScan(fileid)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
t.FailNow()
|
t.FailNow()
|
||||||
}
|
}
|
||||||
t.Log(resp)
|
t.Log(resp)
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -18,7 +18,7 @@ var startup time.Time
|
||||||
|
|
||||||
func Setup(wg *sync.WaitGroup) {
|
func Setup(wg *sync.WaitGroup) {
|
||||||
startup = time.Now()
|
startup = time.Now()
|
||||||
go yara.InitYara()
|
go yara.InitYara()
|
||||||
}
|
}
|
||||||
|
|
||||||
// Submit() starts the analysis process for a file.
|
// Submit() starts the analysis process for a file.
|
||||||
|
|
|
@ -10,18 +10,18 @@ import (
|
||||||
)
|
)
|
||||||
|
|
||||||
func compileSourcesFromFiles() error {
|
func compileSourcesFromFiles() error {
|
||||||
root, err := filepath.Abs(viper.GetString("processing.yararules"))
|
root, err := filepath.Abs(viper.GetString("processing.yararules"))
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error getting absolute path for processing.yararules", "error", err)
|
slog.Error("Error getting absolute path for processing.yararules", "error", err)
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
outputPath, err := filepath.Abs(viper.GetString("processing.yaracompiled"))
|
outputPath, err := filepath.Abs(viper.GetString("processing.yaracompiled"))
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error getting absolute path for processing.yaracompiled", "error", err)
|
slog.Error("Error getting absolute path for processing.yaracompiled", "error", err)
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
cmd := exec.Command("/usr/local/bin/yr", "compile","--path-as-namespace", "--relaxed-re-syntax", "--output", outputPath, root)
|
cmd := exec.Command("/usr/local/bin/yr", "compile", "--path-as-namespace", "--relaxed-re-syntax", "--output", outputPath, root)
|
||||||
slog.Debug("Yara compile command", "cmd", cmd.String())
|
slog.Debug("Yara compile command", "cmd", cmd.String())
|
||||||
result, err := cmd.Output()
|
result, err := cmd.Output()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
|
@ -38,15 +38,15 @@ func scanFile(fileName string) ([]string, error) {
|
||||||
var matched []string
|
var matched []string
|
||||||
outputPath, err := filepath.Abs(viper.GetString("processing.yaracompiled"))
|
outputPath, err := filepath.Abs(viper.GetString("processing.yaracompiled"))
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error getting absolute path for processing.yaracompiled", "error", err)
|
slog.Error("Error getting absolute path for processing.yaracompiled", "error", err)
|
||||||
return matched, err
|
return matched, err
|
||||||
}
|
}
|
||||||
fullPath, err := store.AbsPath(fileName)
|
fullPath, err := store.AbsPath(fileName)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error in Yara Scan", "file-uuid", fileName, "error", err)
|
slog.Error("Error in Yara Scan", "file-uuid", fileName, "error", err)
|
||||||
return matched, err
|
return matched, err
|
||||||
}
|
}
|
||||||
cmd := exec.Command("/usr/local/bin/yr", "scan", "--output-format ndjson", "--print-namespace","--compiled-rules", outputPath, fullPath)
|
cmd := exec.Command("/usr/local/bin/yr", "scan", "--output-format ndjson", "--print-namespace", "--compiled-rules", outputPath, fullPath)
|
||||||
slog.Debug("Yara scan command", "cmd", cmd.String())
|
slog.Debug("Yara scan command", "cmd", cmd.String())
|
||||||
result, err := cmd.Output()
|
result, err := cmd.Output()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
|
|
|
@ -5,28 +5,27 @@ import (
|
||||||
"git.jmbit.de/jmb/scanfile/server/internal/sqlc"
|
"git.jmbit.de/jmb/scanfile/server/internal/sqlc"
|
||||||
)
|
)
|
||||||
|
|
||||||
func InitYara() error{
|
func InitYara() error {
|
||||||
return compileSourcesFromFiles()
|
return compileSourcesFromFiles()
|
||||||
}
|
}
|
||||||
|
|
||||||
func YaraProcessing(job sqlc.ProcessingJob) error {
|
func YaraProcessing(job sqlc.ProcessingJob) error {
|
||||||
database.StartProcessingJob(job.ID)
|
database.StartProcessingJob(job.ID)
|
||||||
results, err := scanFile(job.FileID.String())
|
results, err := scanFile(job.FileID.String())
|
||||||
if err != nil {
|
if err != nil {
|
||||||
database.FailProcessingJob(job.ID, err)
|
database.FailProcessingJob(job.ID, err)
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
params := sqlc.InsertYaraResultsParams{
|
params := sqlc.InsertYaraResultsParams{
|
||||||
FileID: job.FileID,
|
FileID: job.FileID,
|
||||||
Matched: results,
|
Matched: results,
|
||||||
}
|
}
|
||||||
err = database.InsertYaraResults(params)
|
err = database.InsertYaraResults(params)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
database.FailProcessingJob(job.ID, err)
|
database.FailProcessingJob(job.ID, err)
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
return nil
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -12,7 +12,7 @@ func RegisterRoutes() *http.ServeMux {
|
||||||
// Web interface
|
// Web interface
|
||||||
mux.HandleFunc("/", web.IndexWebHandler)
|
mux.HandleFunc("/", web.IndexWebHandler)
|
||||||
mux.HandleFunc("/about", web.AboutWebHandler)
|
mux.HandleFunc("/about", web.AboutWebHandler)
|
||||||
mux.HandleFunc("/admin", web.AdminWebHandler)
|
mux.HandleFunc("/admin", web.AdminWebHandler)
|
||||||
mux.HandleFunc("/files/{uuid}", web.FileViewWebHandler)
|
mux.HandleFunc("/files/{uuid}", web.FileViewWebHandler)
|
||||||
mux.HandleFunc("/files/{uuid}/msoffice", web.FileViewMSOWebHandler)
|
mux.HandleFunc("/files/{uuid}/msoffice", web.FileViewMSOWebHandler)
|
||||||
mux.HandleFunc("/files/{uuid}/download", web.FileViewDownloadWebHandler)
|
mux.HandleFunc("/files/{uuid}/download", web.FileViewDownloadWebHandler)
|
||||||
|
|
|
@ -10,28 +10,27 @@ import (
|
||||||
|
|
||||||
// Returns the MIME type of a file
|
// Returns the MIME type of a file
|
||||||
func GetFileType(fileId string) (string, error) {
|
func GetFileType(fileId string) (string, error) {
|
||||||
start := time.Now()
|
start := time.Now()
|
||||||
path, err := AbsPath(fileId)
|
path, err := AbsPath(fileId)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return "application/octet-stream", nil
|
return "application/octet-stream", nil
|
||||||
}
|
}
|
||||||
mimetype.SetLimit(uint32(viper.GetSizeInBytes("processing.maxmimesize")))
|
mimetype.SetLimit(uint32(viper.GetSizeInBytes("processing.maxmimesize")))
|
||||||
mtype, err := mimetype.DetectFile(path)
|
mtype, err := mimetype.DetectFile(path)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Storage not accessible", "error", err, "file-uuid", fileId, "mimetype", mtype.String())
|
slog.Error("Storage not accessible", "error", err, "file-uuid", fileId, "mimetype", mtype.String())
|
||||||
return "application/octet-stream", err
|
return "application/octet-stream", err
|
||||||
}
|
}
|
||||||
slog.Debug("store.GetFileType", "file-uuid", fileId, "mimetype", mtype.String(), "extension", mtype.Extension(), "duration", time.Now().Sub(start).String())
|
slog.Debug("store.GetFileType", "file-uuid", fileId, "mimetype", mtype.String(), "extension", mtype.Extension(), "duration", time.Now().Sub(start).String())
|
||||||
return mtype.String(), nil
|
return mtype.String(), nil
|
||||||
}
|
}
|
||||||
|
|
||||||
// Returns the MimeType for a []byte
|
// Returns the MimeType for a []byte
|
||||||
// Only pass the necessary data!
|
// Only pass the necessary data!
|
||||||
func GetBytesFileType(data []byte) (string) {
|
func GetBytesFileType(data []byte) string {
|
||||||
mimetype.SetLimit(uint32(viper.GetSizeInBytes("processing.maxmimesize")))
|
mimetype.SetLimit(uint32(viper.GetSizeInBytes("processing.maxmimesize")))
|
||||||
mtype := mimetype.Detect(data)
|
mtype := mimetype.Detect(data)
|
||||||
slog.Debug("GetBytesFileType", "file-mime", mtype.String())
|
slog.Debug("GetBytesFileType", "file-mime", mtype.String())
|
||||||
|
|
||||||
|
|
||||||
return mtype.String()
|
return mtype.String()
|
||||||
}
|
}
|
||||||
|
|
|
@ -9,54 +9,53 @@ import (
|
||||||
)
|
)
|
||||||
|
|
||||||
type testFile struct {
|
type testFile struct {
|
||||||
Name string
|
Name string
|
||||||
MimeType string
|
MimeType string
|
||||||
}
|
}
|
||||||
|
|
||||||
var testFiles = []testFile{
|
var testFiles = []testFile{
|
||||||
{
|
{
|
||||||
Name: "zip.zip",
|
Name: "zip.zip",
|
||||||
MimeType: "application/zip",
|
MimeType: "application/zip",
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
Name: "zip.7z",
|
Name: "zip.7z",
|
||||||
MimeType: "application/x-7z-compressed",
|
MimeType: "application/x-7z-compressed",
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
Name: "test.txt",
|
Name: "test.txt",
|
||||||
MimeType: "text/plain; charset=utf-8",
|
MimeType: "text/plain; charset=utf-8",
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
Name: "macro-example.xlsm",
|
Name: "macro-example.xlsm",
|
||||||
MimeType: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
|
MimeType: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
|
||||||
},
|
},
|
||||||
}
|
}
|
||||||
|
|
||||||
func setconf() error {
|
func setconf() error {
|
||||||
absPath, err := filepath.Abs("../../../tests/files")
|
absPath, err := filepath.Abs("../../../tests/files")
|
||||||
if err != nil {
|
if err != nil {
|
||||||
return err
|
return err
|
||||||
}
|
}
|
||||||
viper.Set("store.path", absPath)
|
viper.Set("store.path", absPath)
|
||||||
return nil
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
func TestFileType(t *testing.T) {
|
func TestFileType(t *testing.T) {
|
||||||
err := setconf()
|
err := setconf()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
t.Fatal(err)
|
t.Fatal(err)
|
||||||
}
|
}
|
||||||
|
|
||||||
for i, file := range testFiles {
|
for i, file := range testFiles {
|
||||||
mimeType, err := store.GetFileType(file.Name)
|
mimeType, err := store.GetFileType(file.Name)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
t.Error(err)
|
t.Error(err)
|
||||||
}
|
}
|
||||||
t.Logf("[%d/%d] File %s Expected: %s, Result: %s", i+1, len(testFiles), file.Name, file.MimeType, mimeType)
|
t.Logf("[%d/%d] File %s Expected: %s, Result: %s", i+1, len(testFiles), file.Name, file.MimeType, mimeType)
|
||||||
if mimeType != file.MimeType {
|
if mimeType != file.MimeType {
|
||||||
t.Fail()
|
t.Fail()
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -7,10 +7,8 @@ import (
|
||||||
"git.jmbit.de/jmb/scanfile/server/internal/database"
|
"git.jmbit.de/jmb/scanfile/server/internal/database"
|
||||||
)
|
)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
func AdminWebHandler(w http.ResponseWriter, r *http.Request) {
|
func AdminWebHandler(w http.ResponseWriter, r *http.Request) {
|
||||||
jobs, err := database.ALlProcessingJobs()
|
jobs, err := database.ALlProcessingJobs()
|
||||||
if err != nil {
|
if err != nil {
|
||||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||||
return
|
return
|
||||||
|
@ -23,5 +21,3 @@ func AdminWebHandler(w http.ResponseWriter, r *http.Request) {
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
|
@ -13,13 +13,13 @@ func FileViewWebHandler(w http.ResponseWriter, r *http.Request) {
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error getting File in FileViewWebHandler", "error", err, "file-uuid", r.PathValue("uuid"))
|
slog.Error("Error getting File in FileViewWebHandler", "error", err, "file-uuid", r.PathValue("uuid"))
|
||||||
if err.Error() == "no rows in result set" {
|
if err.Error() == "no rows in result set" {
|
||||||
http.Error(w, err.Error(), http.StatusNotFound)
|
http.Error(w, err.Error(), http.StatusNotFound)
|
||||||
} else {
|
} else {
|
||||||
http.Error(w, err.Error(), http.StatusBadRequest)
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
||||||
}
|
}
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
fileProperties, err := database.GetFileProperties(file.ID)
|
fileProperties, err := database.GetFileProperties(file.ID)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error getting FileProperties in FileViewWebHandler", "error", err, "file-uuid", r.PathValue("uuid"))
|
slog.Error("Error getting FileProperties in FileViewWebHandler", "error", err, "file-uuid", r.PathValue("uuid"))
|
||||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||||
|
@ -35,14 +35,14 @@ func FileViewWebHandler(w http.ResponseWriter, r *http.Request) {
|
||||||
}
|
}
|
||||||
|
|
||||||
func FileViewMSOWebHandler(w http.ResponseWriter, r *http.Request) {
|
func FileViewMSOWebHandler(w http.ResponseWriter, r *http.Request) {
|
||||||
data, err := database.GetMSOfficeResults(r.PathValue("uuid"))
|
data, err := database.GetMSOfficeResults(r.PathValue("uuid"))
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error getting Data in FileViewMSOWebHandler", "error", err, "file-uuid", r.PathValue("uuid"))
|
slog.Error("Error getting Data in FileViewMSOWebHandler", "error", err, "file-uuid", r.PathValue("uuid"))
|
||||||
http.Error(w, err.Error(), http.StatusBadRequest)
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
component := FileViewMsoffice(data)
|
component := FileViewMsoffice(data)
|
||||||
err = component.Render(r.Context(), w)
|
err = component.Render(r.Context(), w)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error rendering in FileViewMSOWebHandler", "error", err)
|
slog.Error("Error rendering in FileViewMSOWebHandler", "error", err)
|
||||||
http.Error(w, err.Error(), http.StatusBadRequest)
|
http.Error(w, err.Error(), http.StatusBadRequest)
|
||||||
|
@ -51,19 +51,19 @@ func FileViewMSOWebHandler(w http.ResponseWriter, r *http.Request) {
|
||||||
}
|
}
|
||||||
|
|
||||||
func FileViewDeleteWebHandler(w http.ResponseWriter, r *http.Request) {
|
func FileViewDeleteWebHandler(w http.ResponseWriter, r *http.Request) {
|
||||||
fileID := r.PathValue("uuid")
|
fileID := r.PathValue("uuid")
|
||||||
err := database.DeleteFileByID(fileID)
|
err := database.DeleteFileByID(fileID)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error deleting File in FileViewDeleteHandler", "error", err, "file-uuid", fileID)
|
slog.Error("Error deleting File in FileViewDeleteHandler", "error", err, "file-uuid", fileID)
|
||||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
err = store.DeleteFile(fileID)
|
err = store.DeleteFile(fileID)
|
||||||
if err != nil {
|
if err != nil {
|
||||||
slog.Error("Error deleting File in FileViewDeleteHandler", "error", err, "file-uuid", fileID)
|
slog.Error("Error deleting File in FileViewDeleteHandler", "error", err, "file-uuid", fileID)
|
||||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
w.Header().Set("HX-Redirect", "/")
|
w.Header().Set("HX-Redirect", "/")
|
||||||
|
|
||||||
}
|
}
|
||||||
|
@ -82,7 +82,7 @@ func FileViewDownloadWebHandler(w http.ResponseWriter, r *http.Request) {
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
|
||||||
w.Header().Set("Content-Disposition", "attachment; filename="+file.Name)
|
w.Header().Set("Content-Disposition", "attachment; filename="+file.Name)
|
||||||
w.Header().Set("Content-Type", file.Mimetype)
|
w.Header().Set("Content-Type", file.Mimetype)
|
||||||
http.ServeFile(w, r, filePath)
|
http.ServeFile(w, r, filePath)
|
||||||
}
|
}
|
||||||
|
|
Loading…
Add table
Reference in a new issue