diff --git a/configs/go/fileshot/fileshot.yaml b/configs/go/fileshot/fileshot.yaml index d2eac288..96605bc5 100644 --- a/configs/go/fileshot/fileshot.yaml +++ b/configs/go/fileshot/fileshot.yaml @@ -26,8 +26,9 @@ files: positive: - '/glob/to/your/files/*' - '/superglob/to/your/files/**' - # negative # Does not support doublestar ** + # negative # - '/*/badfiles/*' + # - '/**/temp-*.log' minsize: 1 # Limit minimum file size in bytes maxsize: 999999999 # Limit max file size in bytes limitcapacity: 999999999 # Limit max file bandwidth in bytes diff --git a/src/go/cmd/strelka-fileshot/main.go b/src/go/cmd/strelka-fileshot/main.go index 182f7579..23e6e3ed 100644 --- a/src/go/cmd/strelka-fileshot/main.go +++ b/src/go/cmd/strelka-fileshot/main.go @@ -398,19 +398,13 @@ func checkRecentlyModified(modTime time.Time, modified int, verbose bool) (bool, // wildCardToRegexp converts a wildcard pattern to a regular expression pattern. func wildCardToRegexp(pattern string) string { - var result strings.Builder - for i, literal := range strings.Split(pattern, "*") { - // Replace * with .* - if i > 0 { - result.WriteString(".*") - } + result := regexp.QuoteMeta(pattern) + result = strings.Replace(result, "\\*\\*", ".*", -1) + result = strings.Replace(result, "\\*", "[^\\\\]*", -1) + + return result - // Quote any regular expression meta characters in the - // literal text. - result.WriteString(regexp.QuoteMeta(literal)) - } - return result.String() } func sortMatches(matches []matchRich, field string, order string) []matchRich { @@ -503,7 +497,9 @@ func getFilePaths(conf structs.FileShot, verbose *bool, hashes []string) []strin } for _, negativePattern := range conf.Files.Patterns.Negative { - result, _ := regexp.MatchString(wildCardToRegexp(negativePattern), filePath) + re, _ := regexp.Compile("^" + wildCardToRegexp(negativePattern) + "$") + + result := re.Match(([]byte)(filePath)) if result { if *verbose {