Report extraction-relative source paths from artifact_processor#931
Merged
Conversation
An audit of all 559 artifact functions found 483 returning the raw absolute
on-disk path as source_path, leaking the examiner's local filesystem into
HTML report headers and LAVA metadata. Only 64 artifacts shorten via
context.get_relative_path.
Fix it once in the decorator: after the artifact returns, each
newline-separated segment of source_path is passed through
Context.get_relative_path. The helper returns its input unchanged when the
data_folder prefix is absent, so literal values ('See source file column'),
already-relative paths, and runs without a data_folder pass through
untouched. Covers all current artifacts and any future ones.
Note: artifacts that place absolute paths inside per-row 'Source File'
columns are not covered by this and will be fixed separately (~10 files).
Also clears the file's pre-existing lint debt (9.72 -> 10.00) with
zero-behavior-change treatments: explicit datetime imports (timezone stays
re-exported for the 5 artifacts importing it from here), a local rename for
the shadowed timezone name, dead pass/unused-var cleanups, and inline
pragmas where changing signatures or exception behavior would risk the
public API.
abrignoni
added a commit
that referenced
this pull request
Jul 6, 2026
Shorten per-row Source File paths to extraction-relative (follow-up to #931)
stark4n6
pushed a commit
to stark4n6/ALEAPP
that referenced
this pull request
Jul 6, 2026
Follow-up to abrignoni#931 (which shortens the returned source_path centrally): these artifacts also place the absolute on-disk path inside a per-record Source File column, which the decorator cannot see. Wrap each row-inserted copy with Context.get_relative_path; the absolute path is still used for file/db access. Fixed: Life360 (4 artifacts), SimpleStorage_applaunch, battery_usage_v9 (both artifacts), gmailIMAPEmails (emails + accounts), googleChat (all 4 artifacts), knuddels (chats, contacts, account incl. the active_row sources join), thunderbird. Verified false positives left as-is: FacebookMessenger (already shortens via its _src helper), discreteNative (emits basename only), honorMediaLibrary (Source File Path/Name columns are device-side paths from the gallery.db evidence, not examiner paths).
This was referenced Jul 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Audit of all 559 artifact functions: 483 (86%) return the raw absolute path as
source_path, so the examiner's local filesystem (e.g./Users/<name>/...) leaks into HTML report headers and LAVA metadata. Only 64 artifacts usecontext.get_relative_path().Fix
One change in
artifact_processor, applied after every artifact returns:Safe by construction:
get_relative_pathreturns its input unchanged when the data_folder prefix is absent, so literals ("See source file column"), already-relative paths, and run types without a data_folder pass through untouched. The newline split handles the multi-source joined-path convention. Covers all 483 current artifacts plus anything written the same way in the future.Reviewed with @JamesHabben, who correctly noted this is a partial solution: artifacts that drop absolute paths into per-row Source File columns are a separate population (~10 files after excluding false positives like FacebookMessenger's
_src()helper) and will get a targeted follow-up PR.Lint debt
CI lints the whole changed file, so this also clears
ilapfuncs.py's pre-existing debt (9.72 → 10.00) with zero-behavior-change treatments: explicitdatetimeimports (verifiedtimezonestays re-exported for the 5 artifacts importing it from ilapfuncs), a local rename for the shadowedtimezone, deadpass/unused-var cleanups, and inline pragmas where renaming API params (id,type,source_file) or changing exception behavior would risk compatibility.Testing
from scripts.ilapfuncs import timezone, datetimere-export verified intactThe same pattern likely applies to iLEAPP/RLEAPP/VLEAPP; will mirror there after this lands.