PATH:
opt
/
imunify360
/
venv
/
lib
/
python3.11
/
site-packages
/
defence360agent
/
wordpress
/
__pycache__
/
Editing: incident_parser.cpython-311.opt-1.pyc
� ���i � �| � d Z ddlZddlZddlZddlZddlmZ ddlmZ ej e � � Z G d� d� � Z dS )z+Parser for WordPress plugin incident files.� N)�Path)� open_nofollowc � � e Zd ZdZededee fd�� � Zede de dededz fd�� � Z ed e de dededz fd �� � Z dS ) �IncidentFileParsera' Parse incident files written by the WordPress plugin. These files have format: <?php __halt_compiler(); #{base64-encoded JSON data for incident} #{base64-encoded JSON data for incident} ... File pattern: wp-content/imunify-security/incidents/yyyy-mm-dd-hh.php � file_path�returnc � � g } t t |� � � � 5 }t j t j |� � dd�� � 5 }t |d� � D ]G\ }}|� � � }| � |||� � }|�|� |� � �H ddd� � n # 1 swxY w Y ddd� � n # 1 swxY w Y n5# t $ r(}t � d||� � g cY d}~S d}~ww xY w|S )aC Parse an incident file and return list of incident dictionaries. The file format is: - First line: <?php __halt_compiler(); - Following lines: #{base64-encoded JSON} Opens with O_NOFOLLOW to prevent reading arbitrary files if the incident file was replaced with a symlink. �r�utf-8)�encoding� Nz"Error reading incident file %s: %s) r �str�os�fdopen�dup� enumerate�strip� _process_line�append� Exception�logger�error) �clsr � incidents�fd�f�line_num�line�incident�es �^/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/wordpress/incident_parser.py� parse_filez IncidentFileParser.parse_file s� � � � � � �s�9�~�~�.�.� 7�"��Y�r�v�b�z�z�3��A�A�A� 7�Q�*3�A�q�/�/� 7� 7���$� #�z�z�|�|��#&�#4�#4�T�8�Y�#O�#O��#�/� %� ,� ,�X� 6� 6� 6�� 7�7� 7� 7� 7� 7� 7� 7� 7� 7� 7� 7���� 7� 7� 7� 7� 7� 7� 7� 7� 7� 7� 7� 7� 7� 7� 7���� 7� 7� 7� 7��� � � � � �L�L�4��� � � � �I�I�I�I�I�I����� ���� �se � C �*C� AB0�$ C�0B4 �4C�7B4 �8C�; C �C � C �C �C � D� D �:D� Dr r Nc �> � |sdS |� d� � r#t � d||j � � dS |� d� � s,t � d||j |dd� � � dS |dd� }| � |||� � S )aD Process a single line from an incident file. Args: line: The line content (already stripped) line_num: Line number for logging file_path: Path to the file being processed Returns: Parsed incident dictionary or None if line should be skipped Nz<?phpz!Skipping PHP header line %d in %s�#z&Line %d in %s doesn't start with #: %s�2 r )� startswithr �debug�name�_process_encoded_line)r r r r � encoded_datas r! r z IncidentFileParser._process_line; s� � � � ��4� �?�?�7� #� #� � �L�L�3���� � � � �4� ���s�#�#� � �L�L�8�����S�b�S� � � � � �4� �A�B�B�x� ��(�(� �x��K�K�K� r* c � � t j |� � }|� d� � }t j |� � }t |t � � r|S t � d||j |dd� � � dS # t t j f$ r-}t � d||j |� � Y d}~dS d}~ww xY w)aM Decode base64-encoded JSON data from an incident line. Args: encoded_data: Base64-encoded JSON string line_num: Line number for logging file_path: Path to the file being processed Returns: Parsed incident dictionary or None if decoding/parsing fails r z&Line %d in %s is not a JSON object: %sN�d z,Failed to decode base64 on line %d in %s: %s) �base64� b64decode�decode�json�loads� isinstance�dictr �warningr( r �JSONDecodeErrorr )r r* r r � decoded_bytes� decoded_strr r s r! r) z(IncidentFileParser._process_encoded_linee s� � � � "� ,�\� :� :�M�'�.�.�w�7�7�K��z�+�.�.�H��(�D�)�)� � �� �N�N�8�����D�S�D�!� � � � �4���4�/�0� � � � �L�L�>����� � � � �4�4�4�4�4����� ���s �AB �*B �C�"C � C) �__name__� __module__� __qualname__�__doc__� classmethodr �listr4 r" r �intr r) � r+ r! r r s� � � � � � � � � � �4� �D��J� � � � �[� �> �'L��'L�"%�'L�26�'L� ���'L� 'L� 'L� �[�'L�R �%� �%�*-�%�:>�%� ���%� %� %� �[�%� %� %r+ r ) r< r. r1 �loggingr �pathlibr � defence360agent.utils.fd_opsr � getLoggerr9 r r r@ r+ r! �<module>rE s� �� 1� 1� � � � � � � � � ���� � � � � � � � � � � 6� 6� 6� 6� 6� 6� �� �8� $� $��}� }� }� }� }� }� }� }� }� }r+
SAVE
CANCEL