Source code for plaso.engine.filter_file

# -*- coding: utf-8 -*-
"""Filter file."""

import io

from plaso.engine import path_filters

[docs]class FilterFile(object): """Filter file. A filter file contains one or more path filters. A path filter may contain path expansion attributes. Such an attribute is defined as anything within a curly bracket, for example "\\System\\{my_attribute}\\Path\\Keyname". If the attribute "my_attribute" is defined its runtime value will be replaced with placeholder in the path filter such as "\\System\\MyValue\\Path\\Keyname". If the path filter needs to have curly brackets in the path then these need to be escaped with another curly bracket, for example "\\System\\{my_attribute}\\{{123-AF25-E523}}\\KeyName", where "{{123-AF25-E523}}" will be replaced with "{123-AF25-E523}" at runtime. """ def _ReadFromFileObject(self, file_object): """Reads the path filters from the filter file-like object. Args: file_object (file): filter file-like object. Yields: PathFilter: path filter. """ paths = [] for line in file_object: line = line.strip() if line and not line.startswith('#'): paths.append(line) yield path_filters.PathFilter( path_filters.PathFilter.FILTER_TYPE_INCLUDE, paths=paths)
[docs] def ReadFromFile(self, path): """Reads the path filters from the filter file. Args: path (str): path to a filter file. Returns: list[PathFilter]: path filters. """ with, 'r', encoding='utf-8') as file_object: return list(self._ReadFromFileObject(file_object))