[pull] master from kevoreilly:master

web/analysis/templatetags/generic_tags.py

@@ -1,7 +1,5 @@
 from collections import deque
-
 from django.template.defaultfilters import register
-
 from lib.cuckoo.common.utils import convert_to_printable
 
 
@@ -28,27 +26,25 @@ def proctreetolist(tree):
             newnode["name"] = node["name"]
             if "module_path" in node:
                 newnode["module_path"] = node["module_path"]
-            for _com_field in ("com_logical_parent_pid", "com_logical_parent_name",
-                               "com_progid", "com_clsid"):
+            for _com_field in ("com_logical_parent_pid", "com_logical_parent_name", "com_progid", "com_clsid"):
                 if _com_field in node:
                     newnode[_com_field] = node[_com_field]
             if "environ" in node and "CommandLine" in node["environ"]:
-                cmdline = node["environ"]["CommandLine"]
-                if cmdline.startswith('"'):
-                    splitcmdline = cmdline[cmdline[1:].index('"') + 2 :].split()
-                    argv0 = cmdline[: cmdline[1:].index('"') + 1].lower()
-                    if node["module_path"].lower() in argv0:
+                cmdline = node["environ"]["CommandLine"] or ""
+                module_path = (node.get("module_path") or "").lower()
+                closing_quote = cmdline.find('"', 1) if cmdline.startswith('"') else -1
+                if closing_quote != -1:
+                    splitcmdline = cmdline[closing_quote + 1 :].split()
+                    argv0 = cmdline[:closing_quote].lower()
+                    if module_path and module_path in argv0:
                         cmdline = " ".join(splitcmdline).strip()
-                    else:
-                        cmdline = node["environ"]["CommandLine"]
                 elif cmdline:
+                    # Unquoted, or leading quote without a closing one (truncated/malformed).
                     splitcmdline = cmdline.split()
                     if splitcmdline:
-                        argv0 = splitcmdline[0].lower()
-                        if node["module_path"].lower() in argv0:
+                        argv0 = splitcmdline[0].lstrip('"').lower()
+                        if module_path and module_path in argv0:
                             cmdline = " ".join(splitcmdline[1:]).strip()
-                        else:
-                            cmdline = node["environ"]["CommandLine"]
                 if len(cmdline) >= 200 + 15:
                     cmdline = cmdline[:200] + " ...(truncated)"
                 newnode["commandline"] = convert_to_printable(cmdline)