a

q�dg
�@sHdd
lZdd
l
Z
dd
lZdd
lZGdd�de
j�ZedkrDe���
d
S)�Nc@s eZ
dZd
Zdd�Zdd�ZdS)�Plugin�processcCsx
t�
d
|
�}|r*|�d�
}|�d�
p&d}nd}|
}tjdd|tjd�}tjdd	|tjd�}tjd
d|tjd�}tjdd
|tjd�}tjdd
|tjd�}tjdd
|tjd�}tjdd|tjd�}tjdd
|tjd�}tjdd
|tjd�}tjdd
|tjd�}tjdd
|tjd�}tjdd
|tjd�}tjdd
|tjd�}tjdd
|tjd�}||��}t|�
dk�
rt|dd�d}|S)Nz^(\S+)(\s+.*)?$�
��z	(/[^ ]+)+z/***)
�flagszp(--(?:password|pass|pwd|token|secret|key|api-key|access-key|secret-key|client-secret|auth-key|auth-token)\s+\S+)z--***z
(-p\s+\S+)z-p ***za\b(?:password|pass|pwd|token|secret|key|api_key|access_key|client_secret|auth_key|auth_token)=\S+z***z!\b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\bz$\b(?:[a-fA-F0-9:]+:+)+[a-fA-F0-9]+\bz(--port\s+\d+)z
--port ***z�\b(?:DB_PASS|DB_USER|AWS_SECRET_ACCESS_KEY|AWS_ACCESS_KEY_ID|SECRET_KEY|TOKEN|PASSWORD|USERNAME|API_KEY|PRIVATE_KEY|SSH_KEY|SSL_CERTIFICATE|SSL_KEY)\b=\S+z#\b(root|admin|cpanelsolr|user\d*)\bz6(\S+\.(pem|crt|key|cert|csr|pfx|p12|ovpn|enc|asc|gpg))zi\b(?:id_rsa|id_dsa|id_ecdsa|id_ed25519|known_hosts|authorized_keys|credentials|.env|docker-compose.yml)\bzK\b(?:jdbc|mysql|postgres|mongodb|redis|amqp|http|https|ftp|sftp|s3):\/\/\S+z:\b(?:https?|ftp):\/\/(?:\S+\:\S+@)?(?:[a-zA-Z0-9.-]+\.\S+)z2\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b�
�z...)�re�match�group�sub�
IGNORECASE�strip�len)�self�cmdlinerZinitial_pathZremaining_cmdlineZsanitized_cmdline�r�B/usr/local/lib/python3.9/site-packages/agent360/plugins/process.py�sanitize_command_lines0



















zPlugin.sanitize_command_linec
	Gs 
g}t�
�D�
]}z�|jgd
�
d�
}z |�d�|d�
���
|d<Wn


Yn0tjdkr�t|dt�	�dd���|d<t|dt�	�dd�|d<t|d	t�	�dd�|d	<zt|d
t�	�dd�|d
<Wn


Yn0Wn2tj
y�


Yqtj�
y


Yq


Yq0|�|�

q|S)N)	�pid�nameZppid�exer�usernameZcpu_percentZmemory_percentZio_counters)
�attrs�
 r)
��replace)
�errorsrrr)
�psutilZprocess_iterZas_dictr�joinr�sys�version_info�unicode�getdefaultencodingZ
NoSuchProcessZAccessDenied�append)rZunusedr�procZpinforrr�run,s0



 


















z
Plugin.runN)�__name__�
__module__�__qualname__rr'rrrrrs
!r�__main__)rZpluginsr!r
Z
BasePluginrr(�executerrrr�<module>s


D