diff --git a/config/dpkg/changelog b/config/dpkg/changelog index e15d808cb3..d5f06dc585 100644 --- a/config/dpkg/changelog +++ b/config/dpkg/changelog @@ -1,5 +1,5 @@ -plaso (20221227-1) unstable; urgency=low +plaso (20221229-1) unstable; urgency=low * Auto-generated - -- Log2Timeline maintainers Tue, 27 Dec 2022 09:40:48 +0100 + -- Log2Timeline maintainers Thu, 29 Dec 2022 08:14:22 +0100 diff --git a/plaso/__init__.py b/plaso/__init__.py index e2f986ecef..b87d3d376b 100644 --- a/plaso/__init__.py +++ b/plaso/__init__.py @@ -6,4 +6,4 @@ of log2timeline. """ -__version__ = '20221227' +__version__ = '20221229' diff --git a/plaso/formatters/default.py b/plaso/formatters/default.py index 7d9b3fc50b..3e622e49d1 100644 --- a/plaso/formatters/default.py +++ b/plaso/formatters/default.py @@ -45,6 +45,10 @@ def _FormatMessage(self, format_string, event_values): if isinstance(value, dfdatetime_interface.DateTimeValues): continue + if (isinstance(value, list) and value and + isinstance(value[0], dfdatetime_interface.DateTimeValues)): + continue + text_pieces.append('{0:s}: {1!s}'.format(name, value)) return super(DefaultEventFormatter, self)._FormatMessage( diff --git a/plaso/multi_process/output_engine.py b/plaso/multi_process/output_engine.py index 7392bdf951..17402ece4c 100644 --- a/plaso/multi_process/output_engine.py +++ b/plaso/multi_process/output_engine.py @@ -80,6 +80,11 @@ def _GetEventDataContentIdentifier(self, event_data, event_data_stream): if isinstance(attribute_value, dfdatetime_interface.DateTimeValues): continue + if (isinstance(attribute_value, list) and attribute_value and + isinstance(attribute_value[0], + dfdatetime_interface.DateTimeValues)): + continue + if isinstance(attribute_value, dfvfs_path_spec.PathSpec): attribute_value = attribute_value.comparable diff --git a/plaso/output/l2t_csv.py b/plaso/output/l2t_csv.py index 6c144c64df..db18a317ec 100644 --- a/plaso/output/l2t_csv.py +++ b/plaso/output/l2t_csv.py @@ -186,6 +186,11 @@ def _FormatExtraAttributes( if isinstance(attribute_value, dfdatetime_interface.DateTimeValues): continue + if (isinstance(attribute_value, list) and attribute_value and + isinstance(attribute_value[0], + dfdatetime_interface.DateTimeValues)): + continue + # Some parsers have written bytes values to storage. if isinstance(attribute_value, bytes): attribute_value = attribute_value.decode('utf-8', 'replace') diff --git a/plaso/output/rawpy.py b/plaso/output/rawpy.py index f5b0ee3f61..e59a4448ef 100644 --- a/plaso/output/rawpy.py +++ b/plaso/output/rawpy.py @@ -104,6 +104,11 @@ def _GetFormattedEventNativePython( if isinstance(attribute_value, dfdatetime_interface.DateTimeValues): continue + if (isinstance(attribute_value, list) and attribute_value and + isinstance(attribute_value[0], + dfdatetime_interface.DateTimeValues)): + continue + # Some parsers have written bytes values to storage. if isinstance(attribute_value, bytes): attribute_value = attribute_value.decode('utf-8', 'replace') diff --git a/plaso/output/shared_json.py b/plaso/output/shared_json.py index 56320e18f2..4e67f0d9c8 100644 --- a/plaso/output/shared_json.py +++ b/plaso/output/shared_json.py @@ -52,6 +52,11 @@ def _WriteSerializedDict( if isinstance(attribute_value, dfdatetime_interface.DateTimeValues): continue + if (isinstance(attribute_value, list) and attribute_value and + isinstance(attribute_value[0], + dfdatetime_interface.DateTimeValues)): + continue + event_values[attribute_name] = attribute_value if event_data_stream: diff --git a/plaso/output/shared_opensearch.py b/plaso/output/shared_opensearch.py index 7e0b315714..9774e4e4d3 100644 --- a/plaso/output/shared_opensearch.py +++ b/plaso/output/shared_opensearch.py @@ -336,6 +336,11 @@ def _GetSanitizedEventValues( if isinstance(attribute_value, dfdatetime_interface.DateTimeValues): continue + if (isinstance(attribute_value, list) and attribute_value and + isinstance(attribute_value[0], + dfdatetime_interface.DateTimeValues)): + continue + event_values[attribute_name] = attribute_value if event_data_stream: diff --git a/plaso/parsers/filestat.py b/plaso/parsers/filestat.py index 5cc3566e38..0b6d2d6ec7 100644 --- a/plaso/parsers/filestat.py +++ b/plaso/parsers/filestat.py @@ -144,6 +144,9 @@ def ParseFileEntry(self, parser_mediator, file_entry): attribute_names = [] for attribute in file_entry.attributes: attribute_name = getattr(attribute, 'name', None) + if isinstance(attribute_name, bytes): + attribute_name = attribute_name.decode('utf-8') + if file_system_type != 'NTFS' and attribute_name: attribute_names.append(attribute_name)