diff --git a/flow/record/fieldtypes/__init__.py b/flow/record/fieldtypes/__init__.py index ed1337f9..5aa97ad5 100644 --- a/flow/record/fieldtypes/__init__.py +++ b/flow/record/fieldtypes/__init__.py @@ -28,6 +28,7 @@ from flow.record.base import FieldType, Record RE_NORMALIZE_PATH = re.compile(r"[\\/]+") +RE_WINDOWS_PATH = re.compile(r"^[a-zA-Z]:[\\/]") UTC = timezone.utc @@ -602,6 +603,10 @@ def _is_posixlike_path(path: Any) -> bool: if isinstance(path, pathlib.PurePath): obj = getattr(path, "parser", None) or path._flavour return "\\" not in (obj.sep, obj.altsep) + if isinstance(path, str): + if RE_WINDOWS_PATH.match(path): + return False + return "/" in path and "\\" not in path return False @@ -609,6 +614,10 @@ def _is_windowslike_path(path: Any) -> bool: if isinstance(path, pathlib.PurePath): obj = getattr(path, "parser", None) or path._flavour return "\\" in (obj.sep, obj.altsep) + if isinstance(path, str): + if RE_WINDOWS_PATH.match(path): + return True + return "\\" in path return False diff --git a/tests/fieldtypes/test_fieldtypes.py b/tests/fieldtypes/test_fieldtypes.py index c4784b31..65e2b1fd 100644 --- a/tests/fieldtypes/test_fieldtypes.py +++ b/tests/fieldtypes/test_fieldtypes.py @@ -578,7 +578,10 @@ class PureCustomPath(pathlib.PurePath): (custom_pure_path(sep="/", altsep="")("/foo/bar"), True), (custom_pure_path(sep="\\", altsep="/")(r"C:\foo\bar"), False), (custom_pure_path(sep=":", altsep="\\")(r"C:\foo\bar"), False), - ("/foo/bar", False), + ("/foo/bar", True), + (r"C:\foo\bar", False), + (r"C:/foo/bar", False), + (r"\??\C:\Windows\System32\calc.exe", False), ], ) def test__is_posixlike_path(path_: pathlib.PurePath | str, is_posix: bool) -> None: @@ -594,6 +597,9 @@ def test__is_posixlike_path(path_: pathlib.PurePath | str, is_posix: bool) -> No (custom_pure_path(sep="\\", altsep="/")(r"C:\foo\bar"), True), (custom_pure_path(sep=":", altsep="\\")(r"C:\foo\bar"), True), ("/foo/bar", False), + (r"C:\foo\bar", True), + (r"C:/foo/bar", True), + (r"\??\C:\Windows\System32\calc.exe", True), ], ) def test__is_windowslike_path(path_: pathlib.PurePath, is_windows: bool) -> None: @@ -677,7 +683,7 @@ def test_path() -> None: ), ( ("/some/path", pathlib.PureWindowsPath("win/path"), pathlib.PurePosixPath("pos/path")), - flow.record.fieldtypes.windows_path, + flow.record.fieldtypes.posix_path, ), ( (pathlib.PurePosixPath("pos/path"), pathlib.PureWindowsPath("win/path")),