h d Z ddlZddlZddlZddlmZmZ ddlmZ ddl m
Z
m Z ddl m
Z
ddlmZmZ ddlmZ dd lmZmZ G d
d e
ZdS ) u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
N) GeneratorUnion) MessageType) MessageSinkexpect)
nice_iterator)MalwareScanTypeVulnerabilityHitStatus) ProcessOrder) MalwareScanVulnerabilityHitc e Zd Zej Zd Ze d
dee e
f de dz de e ddf fd Z de
ddfdZ eej d ZdS ) StoreVulnerabilitiesc
K d S N )selfloops b/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/plugins/store_vulnerabilities.py create_sinkz StoreVulnerabilities.create_sink& s Npath_obj scan_typereturnc
# K t | t r| gn| }|t j k rt | E d{V dS |D ]y}t j | D ]`}t j | }t j
| rt j
t j |t j t" j t" j g z k r|V t+ j | dz }d t j
t j | t j t" j t" j g D E d{V b{dS )z
Return files that may already not be vulnerable, yet we still
consider them such.
For example, a vulnerable file might have been removed manually.
Nz(/.*|\b)c 3 $ K | ] }|j V d S r ) orig_file).0is r z.P s8 r )
isinstancestrr REALTIMEiterglobiglobospathrealpathisfiler
selectwherer statusin_r
VULNERABLEREVERTEDfirstreescaperegexp)r r paths target_pathr( scanned_dirs r get_outdated_entriesz)StoreVulnerabilities.get_outdated_entries) s )3 7 7E
X 0 0 0E{{ " " " " " " " F K
;//
w''--GNN4(( (/11U(2 *155 6 A 6 ? UWW JJJJ"$)D//K"?K !1!8!:!:!@!@ , 6 = =k J J , 3 7 7$:$E$:$C!" " " )
r summaryc
| dd }| dd }| d =|=|=| |d |d }t j | d S d S d S d S )N
file_patternsexclude_patternserrorr( type)r )popgetr8 r
delete_hits)r r9 r; r< outdated_entriess r _delete_outdated_entriesz-StoreVulnerabilities._delete_outdated_entries] s OT::
";;'94@@ KK ( % ( # 8 876? 9
()9 : : : : :
) (%%((r c | K |d d r|d d S t j |d d }|d d | |d d |d D x}rt | 2 3 d {V \ }}t j |j |d |d |d
|d ||d d
d |d d
d t j s6 d S d S )Nr9 startedresultsscanid)rG r( c f i | ].\ }}t j |d d d +||/S )hitsr matches)r
match)r filenamedatas r
z5StoreVulnerabilities.process_hits..v sL
$ %d6l1oi&@AA
d
r ownerusersizehashrI r rJ timestamp) rG rO rP rQ rR r r> rS r- )
r@ r rC itemsr r
createrG r
r/ )r messagescanrF rL rM s r process_hitsz!StoreVulnerabilities.process_hitsj sv y!%%i00 GI4F4N Fgi&8&BCCC 9 ! !& ) ) 5 ) )')*< = = =
"))"4":":"<"<
7 )6gmmoo(F(F
nh ' ; w- f f f & f a 3 "6l1ok :1<
)G(F(F
s D9r )__name__
__module__ __qualname__r AFTER_STORE_SCANPROCESSING_ORDERr staticmethodr r" listr r8 dictrC r r r rX r r r r r # s #4
!%1 1T "1:1
3d? #1 1 1 \1f ; ; ; ; ; ; VK #$$ %$ r r )__doc__r% r' r2 typingr r "defence360agent.contracts.messagesr !defence360agent.contracts.pluginsr r defence360agent.utilsr imav.malwarelib.configr r
imav.contracts.pluginsr imav.malwarelib.modelr r
r r r r ri s * # # # # # # # # : : : : : : A A A A A A A A / / / / / / J J J J J J J J / / / / / / ? ? ? ? ? ? ? ?e e e e e; e e e e er