Artifacts globstar support incomplete

[aarontp]

Description of problem:
image_export.py's usage of file globs in paths coming from Forensic Artifacts appears to be incomplete. I'm not sure how many of these are by design vs. bugs (if any), but there are a few limitations: ** is supported in the last segment of a path (e.g. the file segment), or in the second to last segment (the last directory segment), but:

• It's not supported anywhere else in the path - addressed by Changes for globstar expansion #2481 #2634
• ** seems to match exactly 3 directories, and not 1-3 directories (e.g. to match /foo/1/2/3/file.txt, /foo/**/file.txt will match, but /foo/1/**/file.txt will not)
• The number expansions to support more directories does not seem to work (e.g. /**5/file.txt will not recurse 5 directories).
• It does not seem to work when it is the start of the last directory segment (e.g. /foo/**bar/file.txt will not work)

A good first step for this might be to document the syntax, and what is expected to work.

Command line and arguments:
$ image_export.py --custom_artifact_definitions /tmp/artifacts/test.yaml --artifact_filters TestConfigFile -w /tmp/output/ /dev/sdd1

Source data:
N/A

Plaso version:
HEAD / latest release

Debug output/tracebacks:
N/A

[joachimmetz]

plaso/plaso/engine/path_helper.py

Line 200 in 7c24390

glob_regex = r'(.*)?{0:s}\*\*(\d{{1,2}})?({0:s})?$'.format(

only detects ** at the end of the path, which is a limitation

[joachimmetz]

ForensicArtifacts/artifacts#342

[joachimmetz]

It does not seem to work when it is the start of the last directory segment (e.g. /foo/**bar/file.txt will not work)

The bash implementation of globstar seems to resolve **bar as *bar/**

[joachimmetz]

** seems to match exactly 3 directories, and not 1-3 directories (e.g. to match /foo/1/2/3/file.txt, /foo//file.txt will match, but /foo/1//file.txt will not)

**5 should be expanded to *, */*, */*/*, */*/*/*, */*/*/*/*

I'll have a look what might not be working for image_export.

Note that for image_export there must be files (data streams) that can be exported.

[joachimmetz]

name: GlobStarTest
doc: globstar test
sources:
- type: FILE
  attributes:
    paths:
      - '\Program Files\**3\*.dll'
    separator: '\'
labels: [Users]
supported_os: [Windows]