Files
Lee Chagolla-Christensen 9d62493623 Type checker, reg parsing improvements, UI improvements (#101)
* fix: upgrade python-multipart to 0.0.22 to address CVE-2026-24486 (Dependabot #683)

* update deps+skill, pyright

* pyright + tests in CLI

* Add pyright type checking and enhance registry hive analysis

Registry Hive Analyzer Enhancements:
- Extract machine SID from SAM domain V value with binary SID decoding
- Extract per-user metadata via regipy (ACB flags, timestamps, full
  name, comment via USER_ACCOUNT_V)
- Compute password expiration from domain max password age policy
- Detect empty LM/NT hashes via well-known constants
- Parse DCC cached domain credentials into structured entries
- Store DPAPI system machine_key/user_key as separate fields
- Add structured secret_type field to LSA secrets (dcc, dpapi_system,
  hex_blob, generic)
- Add detailed markdown and plain-text formatters for SAM accounts
  and LSA secrets, replacing _get_lsa_secret_output_string
- Fix SYSTEM hive attribute names: computer_name -> machinename,
  current_control_set -> currentcontrol
- Switch SAM user iteration from sam.users to sam.secrets (pypykatz API)
- Add FILETIME-to-UTC and regipy value-to-bytes helpers

New Tests:
- Add test_registry_hive.py with SAM, SECURITY, and SYSTEM hive fixtures
- Add test_container.py for container analyzer
- Add SAM/SECURITY/SYSTEM binary test fixtures

Pyright Setup:
- Add pyrightconfig.json (basic mode, Python 3.13) to all libs and projects
- Add pyright>=1.1 as dev dependency to all pyproject.toml files
- Update all uv.lock files accordingly
- Update lint.sh to deactivate active venvs and verify pyright availability

Type Annotation Fixes:
- Fix globals initialized as None without Optional type across
  file_enrichment, document_conversion, and agents global_vars
- Fix StorageMinio return types: upload/upload_file/upload_uploadfile
  return str, not uuid.UUID
- Fix MockStorageMinio to match updated StorageMinio return types
- Add explicit type annotations to dict literals in chromekey.py,
  pdf/analyzer.py, registry_hive/analyzer.py, and publish_findings.py
- Fix kubeconfig current_context parameter to accept str | None
- Fix container_contents allowed_extensions: set = None -> set | None = None
- Fix file subscription file_queue: asyncio.Queue = None -> asyncio.Queue | None = None
- Fix web_api upload_file to wrap object_id in uuid.UUID() for response

None-safety Assertions:
- Add assert statements for asyncpg_pool, tracking_service,
  workflow_client, workflow_manager, file_linking_engine, file_queue,
  gotenberg_url, and process.stdout across all activity, subscription,
  route, and workflow files in file_enrichment and document_conversion
- Add assertions for asyncpg_pool in all chromium processors
- Add assertions for File.from_metadata timestamp/expiration fields
- Add assertion for alerting GQL client session type

Pyright Ignore Annotations:
- Suppress third-party type issues in Dapr workflow/activity APIs,
  gRPC subscription imports, ccache/lnk/office_doc attribute access,
  and nemesis_dpapi FlagMixin operators
- Add file-level suppression for office2john.py, pdf2john.py,
  pe/analyzer.py, and test harness files

Bug Fixes:
- Fix office2john.py format string: bare % filename -> % (filename, stream)
- Fix container analyzer 7z iteration: iterate sz.files list instead
  of calling .items()
- Fix file_linking rules_engine: store match result to avoid double call
- Fix logger.exception calls: remove exception object as first arg in
  storage.py, cookies.py, enrichments.py, housekeeping/main.py
- Fix document_conversion lifespan: use stack.callback() for sync shutdown
- Fix NoseyParkerOutput fallback: add missing workflow_id field
- Fix regipy hive_type: handle None return from RegistryHive.hive_type

DPAPI Manager:
- Remove unused guid parameter from get_system_credentials across
  DpapiManager, NullDpapiManager, and DpapiManagerProtocol

Added Missing Dependencies (file_enrichment_modules):
- pypykatz>=0.6.11, pyarrow>=19.0.1, msoffcrypto-tool>=5.4.2,
  oletools>=0.60.2, regipy>=5.2.0, pillow>=11.3.0

* quiet console logs

* feat: lazy file loading with backend range request support

Add offset/length query params to the download endpoint so the frontend
can request partial file content.  FileViewer now fetches data on demand
— hex, transform (Strings, etc.), ZIP, SQLite, and image tabs only load
when activated.  Text-based content is capped at 10 MB previews.

* fix: transform tabs stuck on "Loading content..."

- Prevent stale WS subscription from overwriting fetched content
- Show retry button when transform content fails to load
- Reset fetch guard on non-OK HTTP responses

* fix: hex tab deferred loading with full file content

* feat: truncation dropdown, spinner overlay, and tab render refactor

- Add truncation dropdown to MonacoContentViewer for files > 10MB,
  replacing the old banner alert and hex "Load Hex View" button
- Add spinner overlay on Monaco editor while loading full content
- Wire truncation support to transform tabs (monaco/json types),
  enrichment tabs, and text tabs
- Change hex tab to auto-load first 10MB preview with dropdown for
  full file instead of requiring manual load
- Default word wrap to off
- Remove "File is too large" warning message
- Refactor ~150-line ternary chain into explicit per-tab render
  functions (renderPreviewTab, renderZipTab, renderSqliteTab,
  renderTextTab, renderHexTab, renderTabContent) with shared helpers
  (renderFullFileContent, getTextContent)

* feat: improve Yara Rules UI

- Compact table rows with tighter padding
- Add X button and Esc key to close editor dialog
- Disable Save button when rule content is unchanged
- Disable Create button with inline warning when rule name already exists
- Default source to "Created manually by <user>" for new rules
- Update source placeholder to "e.g. /yara_rules/custom.yara"

* update gitignore

---------

Co-authored-by: Lee Chagolla-Christensen <lee@localhost>
2026-02-05 14:34:25 -08:00

208 lines
6.4 KiB
Python

"""Tests for cli.monitor module - NewFileHandler with os.fsdecode and Optional source type."""
import logging
import os
from pathlib import Path
from unittest.mock import MagicMock, patch
from cli.monitor import NewFileHandler
class TestNewFileHandlerInit:
def test_default_source_is_none(self):
handler = NewFileHandler(
host="localhost:8080",
username="u",
password="p",
project="proj",
agent_id="agent-1",
logger=logging.getLogger("test"),
)
assert handler.source is None
def test_explicit_source(self):
handler = NewFileHandler(
host="localhost:8080",
username="u",
password="p",
project="proj",
agent_id="agent-1",
logger=logging.getLogger("test"),
source="host://10.0.0.1",
)
assert handler.source == "host://10.0.0.1"
def test_container_default_false(self):
handler = NewFileHandler(
host="localhost:8080",
username="u",
password="p",
project="proj",
agent_id="agent-1",
logger=logging.getLogger("test"),
)
assert handler.container is False
def test_all_attributes_stored(self):
logger = logging.getLogger("test")
handler = NewFileHandler(
host="h",
username="u",
password="p",
project="proj",
agent_id="a",
logger=logger,
container=True,
source="src",
)
assert handler.host == "h"
assert handler.username == "u"
assert handler.password == "p"
assert handler.project == "proj"
assert handler.agent_id == "a"
assert handler.logger is logger
assert handler.container is True
assert handler.source == "src"
class TestNewFileHandlerOnCreated:
def _make_handler(self):
return NewFileHandler(
host="localhost:8080",
username="u",
password="p",
project="proj",
agent_id="agent-1",
logger=logging.getLogger("test"),
source="test-source",
)
@patch("cli.monitor.submit_files")
@patch("cli.monitor.time")
def test_on_created_calls_submit(self, mock_time, mock_submit):
handler = self._make_handler()
event = MagicMock()
event.is_directory = False
event.src_path = "/tmp/test_file.txt"
handler.on_created(event)
mock_submit.assert_called_once_with(
paths=[Path("/tmp/test_file.txt")],
host="localhost:8080",
recursive=False,
workers=1,
username="u",
password="p",
project="proj",
agent_id="agent-1",
container=False,
source="test-source",
)
@patch("cli.monitor.submit_files")
@patch("cli.monitor.time")
def test_on_created_skips_directories(self, mock_time, mock_submit):
handler = self._make_handler()
event = MagicMock()
event.is_directory = True
handler.on_created(event)
mock_submit.assert_not_called()
@patch("cli.monitor.submit_files")
@patch("cli.monitor.time")
def test_on_created_uses_fsdecode(self, mock_time, mock_submit):
"""Verify that os.fsdecode is applied to the event path."""
handler = self._make_handler()
event = MagicMock()
event.is_directory = False
# Simulate a bytes path (which os.fsdecode handles)
event.src_path = os.fsencode("/tmp/test_file.txt")
handler.on_created(event)
# The path should be decoded and passed as a Path object
call_args = mock_submit.call_args
paths = call_args.kwargs.get("paths") or call_args[1].get("paths")
if paths is None:
paths = call_args[0][0] if call_args[0] else None
# Check it was called (the fsdecode would have handled bytes -> str)
mock_submit.assert_called_once()
@patch("cli.monitor.submit_files", side_effect=Exception("network error"))
@patch("cli.monitor.time")
def test_on_created_handles_submit_error(self, mock_time, mock_submit):
"""Errors in submit_files are caught and logged, not propagated."""
handler = self._make_handler()
event = MagicMock()
event.is_directory = False
event.src_path = "/tmp/test_file.txt"
# Should not raise
handler.on_created(event)
class TestNewFileHandlerOnMoved:
def _make_handler(self):
return NewFileHandler(
host="localhost:8080",
username="u",
password="p",
project="proj",
agent_id="agent-1",
logger=logging.getLogger("test"),
)
@patch("cli.monitor.submit_files")
def test_on_moved_calls_submit(self, mock_submit):
handler = self._make_handler()
event = MagicMock()
event.is_directory = False
event.dest_path = "/tmp/moved_file.txt"
handler.on_moved(event)
mock_submit.assert_called_once_with(
paths=[Path("/tmp/moved_file.txt")],
host="localhost:8080",
recursive=False,
workers=1,
username="u",
password="p",
project="proj",
agent_id="agent-1",
container=False,
source=None,
)
@patch("cli.monitor.submit_files")
def test_on_moved_skips_directories(self, mock_submit):
handler = self._make_handler()
event = MagicMock()
event.is_directory = True
handler.on_moved(event)
mock_submit.assert_not_called()
@patch("cli.monitor.submit_files")
def test_on_moved_uses_fsdecode(self, mock_submit):
"""Verify that os.fsdecode is applied to the dest_path."""
handler = self._make_handler()
event = MagicMock()
event.is_directory = False
event.dest_path = os.fsencode("/tmp/moved_file.txt")
handler.on_moved(event)
mock_submit.assert_called_once()
@patch("cli.monitor.submit_files", side_effect=Exception("fail"))
def test_on_moved_handles_submit_error(self, mock_submit):
handler = self._make_handler()
event = MagicMock()
event.is_directory = False
event.dest_path = "/tmp/moved_file.txt"
# Should not raise
handler.on_moved(event)