Add feature to not log entries matching a filter.

nccgroup · Feb 23, 2023 · 756f4a2 · 756f4a2
1 parent cb3e196
commit 756f4a2
Show file tree

Hide file tree

Showing 14 changed files with 150 additions and 61 deletions.
diff --git a/src/main/java/com/nccgroup/loggerplusplus/filter/FilterExpression.java b/src/main/java/com/nccgroup/loggerplusplus/filter/FilterExpression.java
@@ -2,10 +2,12 @@
 
 import com.nccgroup.loggerplusplus.LoggerPlusPlus;
 import com.nccgroup.loggerplusplus.filter.parser.*;
+import com.nccgroup.loggerplusplus.logentry.FieldGroup;
 import com.nccgroup.loggerplusplus.logentry.LogEntry;
 import com.nccgroup.loggerplusplus.logentry.LogEntryField;
 import lombok.Getter;
 
+import java.util.HashMap;
 import java.util.HashSet;
 
 public class FilterExpression {
@@ -16,9 +18,14 @@ public class FilterExpression {
     @Getter
     protected HashSet<String> snippetDependencies;
 
+    @Getter
+    protected HashSet<FieldGroup> requiredContexts;
+
     public FilterExpression(String filterString) throws ParseException {
         this.ast = FilterParser.parseFilter(filterString);
-        this.snippetDependencies = FilterParser.checkAliasesForSanity(LoggerPlusPlus.instance.getLibraryController(), this.ast);
+        HashMap<String, Object> filterInfo = FilterParser.validateFilterDependencies(LoggerPlusPlus.instance.getLibraryController(), this.ast);
+        snippetDependencies = (HashSet<String>) filterInfo.get("dependencies");
+        requiredContexts = (HashSet<FieldGroup>) filterInfo.get("contexts");
     }
 
     public boolean matches(LogEntry entry){
@@ -36,7 +43,9 @@ public void addConditionToFilter(LogicalOperator logicalOperator, LogEntryField
         }
 
         this.ast = FilterParser.parseFilter(String.format("%s %s %s %s %s", existing, logicalOperator.toString(), field.toString(), booleanOperator, value));
-        this.snippetDependencies = FilterParser.checkAliasesForSanity(LoggerPlusPlus.instance.getLibraryController(), this.ast);
+        HashMap<String, Object> filterInfo = FilterParser.validateFilterDependencies(LoggerPlusPlus.instance.getLibraryController(), this.ast);
+        snippetDependencies = (HashSet<String>) filterInfo.get("dependencies");
+        requiredContexts = (HashSet<FieldGroup>) filterInfo.get("contexts");
     }
 
     @Override

diff --git a/src/main/java/com/nccgroup/loggerplusplus/filter/parser/AliasCheckVisitor.java b/src/main/java/com/nccgroup/loggerplusplus/filter/parser/AliasCheckVisitor.java
@@ -3,8 +3,11 @@
 
 import com.nccgroup.loggerplusplus.filter.savedfilter.SavedFilter;
 import com.nccgroup.loggerplusplus.filterlibrary.FilterLibraryController;
+import com.nccgroup.loggerplusplus.logentry.FieldGroup;
+import com.nccgroup.loggerplusplus.logentry.LogEntryField;
 
 import java.util.HashSet;
+import java.util.LinkedList;
 
 public class AliasCheckVisitor implements FilterParserVisitor{
 
@@ -15,7 +18,6 @@ public AliasCheckVisitor(FilterLibraryController filterLibraryController){
   }
 
   public VisitorData defaultVisit(SimpleNode node, VisitorData data){
-    data.setData("dependencies", new HashSet<String>());
     node.childrenAccept(this, data);
     return data;
   }
@@ -24,35 +26,40 @@ public VisitorData visit(SimpleNode node, VisitorData data){
   }
 
   public VisitorData visit(SimpleNode node){
-    return visit(node, new VisitorData());
+    VisitorData visitorData = new VisitorData();
+    visitorData.setData("dependencies", new HashSet<String>());
+    visitorData.setData("contexts", new HashSet<FieldGroup>());
+    visitorData.setData("aliasVisitList", new LinkedList<String>());
+    return visit(node, visitorData);
   }
   public VisitorData visit(ASTExpression node, VisitorData data){
     return defaultVisit(node, data);
   }
   public VisitorData visit(ASTComparison node, VisitorData visitorData){
+    HashSet<FieldGroup> contexts = (HashSet<FieldGroup>) visitorData.getData().get("contexts");
+    if(node.left instanceof LogEntryField) contexts.add(((LogEntryField) node.left).getFieldGroup());
+    if(node.right instanceof LogEntryField) contexts.add(((LogEntryField) node.right).getFieldGroup());
     defaultVisit(node, visitorData);
     return visitorData;
   }
 
   private static String RECURSION_CHECK = "RECURSION_CHECK";
   @Override
   public VisitorData visit(ASTAlias node, VisitorData data) {
+    //Add this alias to our dependencies
     ((HashSet<String>) data.getData().get("dependencies")).add(node.identifier);
     if(filterLibraryController == null){
       data.addError("Cannot use aliases in this context. Filter library controller is not set.");
       return data;
     }
-    if(!data.getData().containsKey(RECURSION_CHECK)){
-      data.getData().put(RECURSION_CHECK, new HashSet<String>());
-    }
 
-    HashSet<String> recursionSet = (HashSet<String>) data.getData().get(RECURSION_CHECK);
-    if(recursionSet.contains(node.identifier)){
+    LinkedList<String> aliasVisitList = (LinkedList<String>) data.getData().get("aliasVisitList");
+    if(aliasVisitList.contains(node.identifier)){
       //We're recursing, don't continue!
       data.addError("Recursion detected in filter. Alias identifier: " + node.identifier);
       return data;
     }else{
-      recursionSet.add(node.identifier);
+      aliasVisitList.push(node.identifier);
     }
 
     //Now sanity check on the aliased filter with our existing data
@@ -61,6 +68,7 @@ public VisitorData visit(ASTAlias node, VisitorData data) {
       if(savedFilter.getName().equalsIgnoreCase(node.identifier) && savedFilter.getFilterExpression() != null){
         visit(savedFilter.getFilterExpression().getAst(), data);
         foundAliasedFilter = true;
+        aliasVisitList.pop();
         break;
       }
     }

diff --git a/src/main/java/com/nccgroup/loggerplusplus/filter/parser/Filter.jj b/src/main/java/com/nccgroup/loggerplusplus/filter/parser/Filter.jj
@@ -20,6 +20,7 @@ import java.math.BigDecimal;
 import java.util.Arrays;
 import java.util.LinkedHashSet;
 import java.util.HashSet;
+import java.util.HashMap;
 import java.util.Set;
 import java.util.Date;
 import java.util.ArrayList;
@@ -41,10 +42,10 @@ public class FilterParser/*@bgen(jjtree)*/implements FilterParserTreeConstants/*
         return node;
     }
 
-    public static HashSet<String> checkAliasesForSanity(FilterLibraryController libraryController, ASTExpression filter) throws ParseException {
+    public static HashMap<String, Object> validateFilterDependencies(FilterLibraryController libraryController, ASTExpression filter) throws ParseException {
         VisitorData result = new AliasCheckVisitor(libraryController).visit(filter);
         if(!result.isSuccess()) throw new ParseException(result.getErrorString());
-        return (HashSet<String>) result.getData().get("dependencies");
+        return result.getData();
     }
 
     private static void throwOperatorAmbiguityException(LogicalOperator op, LogicalOperator other) throws ParseException {

diff --git a/src/main/java/com/nccgroup/loggerplusplus/filter/parser/Filter.jjt b/src/main/java/com/nccgroup/loggerplusplus/filter/parser/Filter.jjt
@@ -19,6 +19,7 @@ import java.math.BigDecimal;
 import java.util.Arrays;
 import java.util.LinkedHashSet;
 import java.util.HashSet;
+import java.util.HashMap;
 import java.util.Set;
 import java.util.Date;
 import java.util.ArrayList;
@@ -37,10 +38,10 @@ public class FilterParser {
         return node;
     }
 
-    public static HashSet<String> checkAliasesForSanity(FilterLibraryController libraryController, ASTExpression filter) throws ParseException {
+    public static HashMap<String, Object> validateFilterDependencies(FilterLibraryController libraryController, ASTExpression filter) throws ParseException {
         VisitorData result = new AliasCheckVisitor(libraryController).visit(filter);
         if(!result.isSuccess()) throw new ParseException(result.getErrorString());
-        return (HashSet<String>) result.getData().get("dependencies");
+        return result.getData();
     }
 
     private static void throwOperatorAmbiguityException(LogicalOperator op, LogicalOperator other) throws ParseException {

diff --git a/src/main/java/com/nccgroup/loggerplusplus/filter/parser/FilterParser.java b/src/main/java/com/nccgroup/loggerplusplus/filter/parser/FilterParser.java
@@ -8,6 +8,7 @@
 import java.util.Arrays;
 import java.util.LinkedHashSet;
 import java.util.HashSet;
+import java.util.HashMap;
 import java.util.Set;
 import java.util.Date;
 import java.util.ArrayList;
@@ -26,10 +27,10 @@ public static ASTExpression parseFilter(String string) throws ParseException {
         return node;
     }
 
-    public static HashSet<String> checkAliasesForSanity(FilterLibraryController libraryController, ASTExpression filter) throws ParseException {
+    public static HashMap<String, Object> validateFilterDependencies(FilterLibraryController libraryController, ASTExpression filter) throws ParseException {
         VisitorData result = new AliasCheckVisitor(libraryController).visit(filter);
         if(!result.isSuccess()) throw new ParseException(result.getErrorString());
-        return (HashSet<String>) result.getData().get("dependencies");
+        return result.getData();
     }
 
     private static void throwOperatorAmbiguityException(LogicalOperator op, LogicalOperator other) throws ParseException {
@@ -762,11 +763,6 @@ private boolean jj_2_4(int xla) {
     finally { jj_save(3, xla); }
   }
 
-  private boolean jj_3_4() {
-    if (jj_3R_9()) return true;
-    return false;
-  }
-
   private boolean jj_3R_18() {
     if (jj_3R_21()) return true;
     return false;
@@ -979,6 +975,11 @@ private boolean jj_3R_13() {
     return false;
   }
 
+  private boolean jj_3_4() {
+    if (jj_3R_9()) return true;
+    return false;
+  }
+
   /** Generated Token Manager. */
   public FilterParserTokenManager token_source;
   SimpleCharStream jj_input_stream;

diff --git a/src/main/java/com/nccgroup/loggerplusplus/filter/parser/FilterParserTokenManager.java b/src/main/java/com/nccgroup/loggerplusplus/filter/parser/FilterParserTokenManager.java
@@ -8,6 +8,7 @@
 import java.util.Arrays;
 import java.util.LinkedHashSet;
 import java.util.HashSet;
+import java.util.HashMap;
 import java.util.Set;
 import java.util.Date;
 import java.util.ArrayList;

diff --git a/src/main/java/com/nccgroup/loggerplusplus/logentry/LogEntry.java b/src/main/java/com/nccgroup/loggerplusplus/logentry/LogEntry.java
@@ -41,6 +41,8 @@
 import java.util.regex.Matcher;
 import java.util.stream.Collectors;
 
+import static com.nccgroup.loggerplusplus.LoggerPlusPlus.montoya;
+
 @Getter
 @Setter
 public class LogEntry {
@@ -138,11 +140,7 @@ public boolean process() {
 		switch (this.status) {
 			case UNPROCESSED: {
 				this.status = processRequest();
-				// If the entry should be ignored, stop here.
-				if (this.status == Status.IGNORED)
-					return true;
-
-				// Else continue, fall through to process response
+				//fall through to process response
 			}
 			case AWAITING_RESPONSE: {
 				if (this.response == null) {
@@ -154,7 +152,6 @@ public boolean process() {
 				return true;
 			}
 
-			case IGNORED:
 			case PROCESSED: {
 				// Nothing to do, we're done!
 				return true;
@@ -233,7 +230,7 @@ private Status processRequest() {
 						this.sentCookies += ";"; // we need to ad this to search it in cookie Jar!
 
 						// Check to see if it uses cookie Jars!
-						List<Cookie> cookiesInJar = LoggerPlusPlus.montoya.http().cookieJar().cookies();
+						List<Cookie> cookiesInJar = montoya.http().cookieJar().cookies();
 						boolean oneNotMatched = false;
 						boolean anyParamMatched = false;
 
@@ -529,6 +526,8 @@ public Object getValueByKey(LogEntryField columnName) {
 
 		try {
 			switch (columnName) {
+				case INSCOPE:
+					return montoya.scope().isInScope(urlString);
 				case PROXY_TOOL:
 				case REQUEST_TOOL:
 					return tool.toolName();

diff --git a/src/main/java/com/nccgroup/loggerplusplus/logentry/LogEntryField.java b/src/main/java/com/nccgroup/loggerplusplus/logentry/LogEntryField.java
@@ -12,6 +12,8 @@ public enum LogEntryField {
     NUMBER(FieldGroup.ENTRY, Integer.class, "Item table number. Not valid for filter use.", "Number"),
     PROXY_TOOL(FieldGroup.ENTRY, String.class, "Originating tool name. Extension generated requests will be displayed as \"Extender\".", "Tool"),
     TAGS(FieldGroup.ENTRY, String.class, "The configured tags for which this entry match.", "Tags"),
+
+    INSCOPE(FieldGroup.ENTRY, Boolean.class, "If the URL is in scope", "InScope"),
     LISTENER_INTERFACE(FieldGroup.ENTRY, String.class, "The interface the proxied message was delivered to.", "ListenInterface", "Interface"),
     CLIENT_IP(FieldGroup.ENTRY, String.class, "The requesting client IP address.", "ClientIP", "ClientAddress"),
 

diff --git a/src/main/java/com/nccgroup/loggerplusplus/logentry/Status.java b/src/main/java/com/nccgroup/loggerplusplus/logentry/Status.java
@@ -1,5 +1,5 @@
 package com.nccgroup.loggerplusplus.logentry;
 
 public enum Status {
-    UNPROCESSED, AWAITING_RESPONSE, PROCESSED, IGNORED
+    UNPROCESSED, AWAITING_RESPONSE, PROCESSED
 }
diff --git a/src/main/java/com/nccgroup/loggerplusplus/logview/processor/EntryImportWorker.java b/src/main/java/com/nccgroup/loggerplusplus/logview/processor/EntryImportWorker.java
@@ -59,7 +59,7 @@ protected Void doInBackground() throws Exception {
                 if(this.isCancelled()) return;
                 LogEntry result = logProcessor.processEntry(logEntry);
                 if(result != null) {
-                    logProcessor.addProcessedEntry(logEntry, sendToAutoExporters);
+                    logProcessor.addNewEntry(logEntry, sendToAutoExporters);
                 }
                 publish(finalIndex);
                 countDownLatch.countDown();