You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The --filters parameter appears to break the JSONL renderer when a parent TreeNode does not match the filter criteria. This does not appear to be a problem in other renderers.
To Reproduce
Run a plugin that produces an actual tree-like set of results, like pstree or amcache, with the jsonl renderer and a --filters parameter that is guaranteed to filter out every entry except one, which must be a child of another node.
Expected behavior
IMO, sane behavior would be for parent nodes to still be included in the resulting output, in order to preserve the 'depth' of the result. However this is not the case with other renderers - should it be?
I think it'll get pretty messy if we have to start figuring out which parent nodes we'll need to keep. I figured jsonl would just reference a previous node, so we can either put "filtered" or something else to indicate the parent isn't present.
As for other plugins, I'd expect them to float standalone at whatever level they were at. I don't know if we care about the tree integrity if the user has asked specifically only to see the filtered rows. I feel it's kind of up to the UI, so something wanting to use an actual tree display may require earlier entries, but as a CLI, I'm not sure that's a requirement? It's not a strong feeling, but otherwise every rendered would become a slow renderer because you may have to parse all the results to know if the first one should be output or not...
What do you think? I've only got a mild view towards it?
The --filters parameter appears to break the JSONL renderer when a parent
TreeNode
does not match the filter criteria. This does not appear to be a problem in other renderers.Context
Volatility Version: 2.11.0
Operating System: macOS
Python Version: 3.8.10
To Reproduce
Run a plugin that produces an actual tree-like set of results, like
pstree
oramcache
, with thejsonl
renderer and a--filters
parameter that is guaranteed to filter out every entry except one, which must be a child of another node.Expected behavior
IMO, sane behavior would be for parent nodes to still be included in the resulting output, in order to preserve the 'depth' of the result. However this is not the case with other renderers - should it be?
Example output
This works fine:
The text was updated successfully, but these errors were encountered: