diff --git a/web/analysis/templatetags/generic_tags.py b/web/analysis/templatetags/generic_tags.py index 2b602b907af..e61941ed8b6 100644 --- a/web/analysis/templatetags/generic_tags.py +++ b/web/analysis/templatetags/generic_tags.py @@ -1,7 +1,5 @@ from collections import deque - from django.template.defaultfilters import register - from lib.cuckoo.common.utils import convert_to_printable @@ -28,27 +26,25 @@ def proctreetolist(tree): newnode["name"] = node["name"] if "module_path" in node: newnode["module_path"] = node["module_path"] - for _com_field in ("com_logical_parent_pid", "com_logical_parent_name", - "com_progid", "com_clsid"): + for _com_field in ("com_logical_parent_pid", "com_logical_parent_name", "com_progid", "com_clsid"): if _com_field in node: newnode[_com_field] = node[_com_field] if "environ" in node and "CommandLine" in node["environ"]: - cmdline = node["environ"]["CommandLine"] - if cmdline.startswith('"'): - splitcmdline = cmdline[cmdline[1:].index('"') + 2 :].split() - argv0 = cmdline[: cmdline[1:].index('"') + 1].lower() - if node["module_path"].lower() in argv0: + cmdline = node["environ"]["CommandLine"] or "" + module_path = (node.get("module_path") or "").lower() + closing_quote = cmdline.find('"', 1) if cmdline.startswith('"') else -1 + if closing_quote != -1: + splitcmdline = cmdline[closing_quote + 1 :].split() + argv0 = cmdline[:closing_quote].lower() + if module_path and module_path in argv0: cmdline = " ".join(splitcmdline).strip() - else: - cmdline = node["environ"]["CommandLine"] elif cmdline: + # Unquoted, or leading quote without a closing one (truncated/malformed). splitcmdline = cmdline.split() if splitcmdline: - argv0 = splitcmdline[0].lower() - if node["module_path"].lower() in argv0: + argv0 = splitcmdline[0].lstrip('"').lower() + if module_path and module_path in argv0: cmdline = " ".join(splitcmdline[1:]).strip() - else: - cmdline = node["environ"]["CommandLine"] if len(cmdline) >= 200 + 15: cmdline = cmdline[:200] + " ...(truncated)" newnode["commandline"] = convert_to_printable(cmdline)