OwlCyberSecurity - MANAGER
Edit File: incident_parser.cpython-311.pyc
� tsiG � �h � d Z ddlZddlZddlZddlmZ ej e� � Z G d� d� � Z dS )z+Parser for WordPress plugin incident files.� N)�Pathc � � e Zd ZdZededee fd�� � Zede de dededz fd�� � Z ed e de dededz fd �� � Z dS ) �IncidentFileParsera' Parse incident files written by the WordPress plugin. These files have format: <?php __halt_compiler(); #{base64-encoded JSON data for incident} #{base64-encoded JSON data for incident} ... File pattern: wp-content/imunify-security/incidents/yyyy-mm-dd-hh.php � file_path�returnc �~ � g } t |dd�� � 5 }t |d� � D ]G\ }}|� � � }| � |||� � }|�|� |� � �H ddd� � n # 1 swxY w Y n5# t $ r(}t � d||� � g cY d}~S d}~ww xY w|S )aS Parse an incident file and return list of incident dictionaries. The file format is: - First line: <?php __halt_compiler(); - Following lines: #{base64-encoded JSON} Args: file_path: Path to the incident file Returns: List of parsed incident dictionaries �r�utf-8)�encoding� Nz"Error reading incident file %s: %s)�open� enumerate�strip� _process_line�append� Exception�logger�error)�clsr � incidents�f�line_num�line�incident�es �^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/incident_parser.py� parse_filez IncidentFileParser.parse_file s. � � � � ��i��w�7�7�7� 3�1�&/��1�o�o� 3� 3�N�H�d� �:�:�<�<�D� "� 0� 0��x�� K� K�H� �+�!�(�(��2�2�2�� 3� 3� 3� 3� 3� 3� 3� 3� 3� 3� 3� 3���� 3� 3� 3� 3��� � � � � �L�L�4��� � � � �I�I�I�I�I�I����� ���� �sA �B �AA<�0 B �<B � B �B �B � B:� B5�/B:�5B:r r Nc �> � |sdS |� d� � r#t � d||j � � dS |� d� � s,t � d||j |dd� � � dS |dd� }| � |||� � S )aD Process a single line from an incident file. Args: line: The line content (already stripped) line_num: Line number for logging file_path: Path to the file being processed Returns: Parsed incident dictionary or None if line should be skipped Nz<?phpz!Skipping PHP header line %d in %s�#z&Line %d in %s doesn't start with #: %s�2 r )� startswithr �debug�name�_process_encoded_line)r r r r � encoded_datas r r z IncidentFileParser._process_line< s� � � � ��4� �?�?�7� #� #� � �L�L�3���� � � � �4� ���s�#�#� � �L�L�8�����S�b�S� � � � � �4� �A�B�B�x� ��(�(� �x��K�K�K� r% c � � t j |� � }|� d� � }t j |� � }t |t � � r|S t � d||j |dd� � � dS # t t j f$ r-}t � d||j |� � Y d}~dS d}~ww xY w)aM Decode base64-encoded JSON data from an incident line. Args: encoded_data: Base64-encoded JSON string line_num: Line number for logging file_path: Path to the file being processed Returns: Parsed incident dictionary or None if decoding/parsing fails r z&Line %d in %s is not a JSON object: %sN�d z,Failed to decode base64 on line %d in %s: %s) �base64� b64decode�decode�json�loads� isinstance�dictr �warningr# r �JSONDecodeErrorr )r r% r r � decoded_bytes� decoded_strr r s r r$ z(IncidentFileParser._process_encoded_linef s� � � � "� ,�\� :� :�M�'�.�.�w�7�7�K��z�+�.�.�H��(�D�)�)� � �� �N�N�8�����D�S�D�!� � � � �4���4�/�0� � � � �L�L�>����� � � � �4�4�4�4�4����� ���s �AB �*B �C�"C � C) �__name__� __module__� __qualname__�__doc__� classmethodr �listr/ r �str�intr r$ � r& r r r s� � � � � � � � � �!�4� !�D��J� !� !� !� �[�!�F �'L��'L�"%�'L�26�'L� ���'L� 'L� 'L� �[�'L�R �%� �%�*-�%�:>�%� ���%� %� %� �[�%� %� %r& r ) r7 r) r, �logging�pathlibr � getLoggerr4 r r r< r& r �<module>r@ s� �� 1� 1� � � � � � � � � ���� � � � � � � �� �8� $� $��A� A� A� A� A� A� A� A� A� Ar&