Re: [sleuthkit-users] Autopsy-1.70 UTF-8 patch

[Minoru K. <co...@ex...>]

Brian Carrier wrote <200...@ba...>:

>> And, I found a problem of Autopsy when a browser send a long long 
>> request to Autopsy (see 
>http://www.asahi-net.or.jp/~uu8m-kbys/long-request.txt).
>> 
>> If a long request is sent, Autopsy will not be processed normally.
>> A file content frame and a file type frame are not displayed.
>
>I just tried the NTFS image you supplied and it worked for me 
>(w/out either of the the UNICODE patches).  What browser are
>you using?  Try to open each of the frames in their own window
>and see what it does.

This problem occurs only when a UNICODE patch is applied.
It will occur, if a very long Japanese file name is accessed within a 
file list frame (I use Phoenix for the browser).

The Japanese file name expressed with UTF-8 is processed with a 
'url_encode' function, and becomes still longer. Therefore, the link 
of a very long name is generated in the file list frame. The request 
and reply when clicking this link are as follows.

Request 1: http://www.asahi-net.or.jp/~uu8m-kbys/autopsy/request1.txt
Request 2: http://www.asahi-net.or.jp/~uu8m-kbys/autopsy/request2.txt
Request 3: http://www.asahi-net.or.jp/~uu8m-kbys/autopsy/request3.txt

Please see request 2. Autopsy will not output after the reply of 
"HTTP/1.0 200 OK". This seems not to invoke the 'autopsy_main' 
function.

This problem is occured even when the 'dir' argument is the usual 
alphabet. For example, also in continuous 'A' of about 2000 
characters, the contents of the 'dir' argument occur.

# However, it is sometimes displayed normally.
# I do not understand a cause.

>                       I'm also curious to see what your patch
>passes in the 'dir' argument on the GET request.

My patch shortens a character sequence, when the 'dir' argument is 
256 or more characters, in order to avoid the above-mentioned 
problem. However, this code is imperfect.

http://www.asahi-net.or.jp/~uu8m-kbys/autopsy/mypatched-request.txt

>                                                  I'm not sure
>if the url_decode and url_encode function will handle the UTF-8
>correctly.  

As for these functions, I seem to be able to handle UTF-8 correctly.
However, please remember that I am not Perl wizard. Furthermore, I 
am not detailed to UTF-8, either.

And, I corrected the 'check_inode' function.
New patch is here.
http://www.asahi-net.or.jp/~uu8m-kbys/autopsy/autopsy-utf8-6.patch


Best regards.

-- 
Minoru Kobayashi mailto:co...@ex...