{"action":"created","issue":{"url":"https://api.github.com/repos/google/grr/issues/263","labels_url":"https://api.github.com/repos/google/grr/issues/263/labels{/name}","comments_url":"https://api.github.com/repos/google/grr/issues/263/comments","events_url":"https://api.github.com/repos/google/grr/issues/263/events","html_url":"https://github.com/google/grr/issues/263","id":109403764,"number":263,"title":"Hex string literals no longer work in FileFinder","user":{"login":"destijl","id":1291767,"avatar_url":"https://avatars.githubusercontent.com/u/1291767?v=3","gravatar_id":"","url":"https://api.github.com/users/destijl","html_url":"https://github.com/destijl","followers_url":"https://api.github.com/users/destijl/followers","following_url":"https://api.github.com/users/destijl/following{/other_user}","gists_url":"https://api.github.com/users/destijl/gists{/gist_id}","starred_url":"https://api.github.com/users/destijl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/destijl/subscriptions","organizations_url":"https://api.github.com/users/destijl/orgs","repos_url":"https://api.github.com/users/destijl/repos","events_url":"https://api.github.com/users/destijl/events{/privacy}","received_events_url":"https://api.github.com/users/destijl/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/google/grr/labels/bug","name":"bug","color":"fc2929"}],"state":"closed","locked":false,"assignee":{"login":"mbushkov","id":904981,"avatar_url":"https://avatars.githubusercontent.com/u/904981?v=3","gravatar_id":"","url":"https://api.github.com/users/mbushkov","html_url":"https://github.com/mbushkov","followers_url":"https://api.github.com/users/mbushkov/followers","following_url":"https://api.github.com/users/mbushkov/following{/other_user}","gists_url":"https://api.github.com/users/mbushkov/gists{/gist_id}","starred_url":"https://api.github.com/users/mbushkov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mbushkov/subscriptions","organizations_url":"https://api.github.com/users/mbushkov/orgs","repos_url":"https://api.github.com/users/mbushkov/repos","events_url":"https://api.github.com/users/mbushkov/events{/privacy}","received_events_url":"https://api.github.com/users/mbushkov/received_events","type":"User","site_admin":false},"milestone":null,"comments":2,"created_at":"2015-10-01T23:22:32Z","updated_at":"2015-11-06T23:52:26Z","closed_at":"2015-11-06T23:52:26Z","body":"To search for a mach-o you used to be able to use FileFinder with a string literal:\r\n\r\n\\xca\\xfe   etc.\r\n\r\nBut with the new UI this gets escaped:\r\n```\r\n{\"runner_args\":{\"flow_name\":\"FileFinder\",\"output_plugins\":[]},\"flow_args\":{\"paths\":[\"/usr/bin/file\"],\"conditions\":[{\"modification_time\":{\"max_last_modified_time\":null},\"condition_type\":\"CONTENTS_LITERAL_MATCH\",\"contents_literal_match\":{\"literal\":\"\\\\xca\\\\xfe\",\"mode\":\"FIRST_HIT\",\"start_offset\":0,\"length\":10737418240,\"bytes_before\":10,\"bytes_after\":10,\"xor_in_key\":0,\"xor_out_key\":0}}]}}:\r\n```\r\nand never un-escaped. In the old UI we used to unescape with .decode(\"string_escape\") for LiteralExpression rdf values:\r\nhttps://github.com/google/grr/blob/69c81624c281216a45c4bb88a9d4e4b0613a3556/gui/plugins/flow_management.py#L991\r\nhttps://github.com/google/grr/blob/919a844c396136bd49c457f18d853dd10b79abed/gui/plugins/forms.py#L329\r\n\r\nbut the new UI doesn't do this. And it's actually a more general problem of trying to deliver bytes via JSON without encoding.\r\n\r\nAfter discussing with @scudette we think we should explicitly force the angular code to encode it \r\nin one of three ways:\r\n\r\n- as a unicode string, then we decode it into utf8\r\n- as an object {encoding: \"hex\", data: \"CAFEBABE\"}\r\n- or {encoding: \"string\", data: \"\\xCA\\xFE\"}\r\n\r\nand it should be possible for the user to toggle the string literal field between each of these inputs so it's explicit about what they are sending (probably a new directive for RDFBytes and LiteralExpression types).\r\n\r\nThis also means that if you choose \"hex\" input the angular code could strip whitespace and check you have full bytes specified, so that you can just paste a string in from your hex editor like:\r\n\r\n```\r\n4D 5A 90 00  03\r\n```\r\n\r\nand it would do the right thing, rather than having to mess around adding \\x's and deleting spaces.\r\n"},"comment":{"url":"https://api.github.com/repos/google/grr/issues/comments/154580106","html_url":"https://github.com/google/grr/issues/263#issuecomment-154580106","issue_url":"https://api.github.com/repos/google/grr/issues/263","id":154580106,"user":{"login":"destijl","id":1291767,"avatar_url":"https://avatars.githubusercontent.com/u/1291767?v=3","gravatar_id":"","url":"https://api.github.com/users/destijl","html_url":"https://github.com/destijl","followers_url":"https://api.github.com/users/destijl/followers","following_url":"https://api.github.com/users/destijl/following{/other_user}","gists_url":"https://api.github.com/users/destijl/gists{/gist_id}","starred_url":"https://api.github.com/users/destijl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/destijl/subscriptions","organizations_url":"https://api.github.com/users/destijl/orgs","repos_url":"https://api.github.com/users/destijl/repos","events_url":"https://api.github.com/users/destijl/events{/privacy}","received_events_url":"https://api.github.com/users/destijl/received_events","type":"User","site_admin":false},"created_at":"2015-11-06T23:52:26Z","updated_at":"2015-11-06T23:52:26Z","body":"Now fixed"}}