Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Load .json.gz files directly #1990

Merged
merged 8 commits into from
Feb 25, 2024
Merged

Conversation

Rohit1123
Copy link
Contributor

@Rohit1123 Rohit1123 commented Feb 17, 2024

closes #1883

For loading .json.gz files directly, used the code from tests:

def get_cape_extractor(path):

Checklist

  • No CHANGELOG update needed
  • No new tests needed
  • No documentation update needed

Copy link

google-cla bot commented Feb 17, 2024

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

capa/helpers.py Outdated
@@ -71,7 +71,11 @@ def assert_never(value) -> NoReturn:


def get_format_from_report(sample: Path) -> str:
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this function should return the report format, not the report itself

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I didn't understand. The function returns report format right - FORMAT_CAPE or FORMAT_UNKNOWN

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ah sorry, my bad, you are correct, however, there's other locations where cape reports (JSON) are read, see references to json.load, would you change those as well? likely a helper function to load plain or compressed reports would be useful.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mr-tz, as you suggested, I've created a helper function load_json_from_path that can load both plain and compressed JSON reports, and there are still a few json.loads references, but they are used on strings, not for loading JSON reports (if I'm not wrong)

Copy link
Collaborator

@mr-tz mr-tz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this looks great, please address my comments and add a test e.g. in test_main (test_main_cape_gz or similar)

capa/helpers.py Outdated Show resolved Hide resolved
@mr-tz
Copy link
Collaborator

mr-tz commented Feb 22, 2024

and please add an entry in the changelog so we can recognize your work!

@Rohit1123
Copy link
Contributor Author

@mr-tz, thanks for the feedback. I've added a test and made an entry in change log.
And lint with ruff is failing because json is imported but unused in capa/loader.py. May I discard import json?

@mr-tz
Copy link
Collaborator

mr-tz commented Feb 22, 2024

yes, please

@Rohit1123 Rohit1123 requested a review from mr-tz February 23, 2024 09:52
Copy link
Collaborator

@mr-tz mr-tz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

almost ready to go, thank you!

tests/test_main.py Outdated Show resolved Hide resolved
Copy link
Collaborator

@mr-tz mr-tz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

amazing, thank you!

@mr-tz mr-tz merged commit 9a449b6 into mandiant:master Feb 25, 2024
25 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Load .json.gz files directly
2 participants