Gfs/649+652 (#653)

microsoft · May 2, 2022 · 7c5be27 · 7c5be27
1 parent a7f7c84
commit 7c5be27
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 3 deletions.
diff --git a/Cli/AttackSurfaceAnalyzerClient.cs b/Cli/AttackSurfaceAnalyzerClient.cs
@@ -13,6 +13,7 @@
 using Newtonsoft.Json.Serialization;
 using Serilog;
 using System;
+using System.Collections;
 using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.Diagnostics;
@@ -764,7 +765,7 @@ public static SarifLog GenerateSarifLog(Dictionary<string, object> output, IEnum
 
             foreach (var item in results)
             {
-                var compareResults = (List<CompareResult>)item.Value;
+                var compareResults = (IEnumerable<CompareResult>)item.Value;
                 foreach (var compareResult in compareResults)
                 {
                     if (!artifacts.Any(a => a.Location.Description.Text.ToString() == compareResult.Identity))

diff --git a/Lib/Collectors/OpenPortCollector.cs b/Lib/Collectors/OpenPortCollector.cs
@@ -51,9 +51,11 @@ internal override void ExecuteInternal(CancellationToken cancellationToken)
 Netid State  Recv-Q Send-Q                              Local Address:Port        Peer Address:PortProcess                                                          
 nl    UNCONN 0      0                                               0:530                     *                                                                     
 */
+        // See https://github.com/microsoft/AttackSurfaceAnalyzer/issues/649 for discussion on this regex and potential other solutions parsing sock files directly.
         private static Regex LinuxSsParsingRegex { get; } = new Regex(
-            "([\\S]+)\\s+([\\S]+)\\s+([\\S]+)\\s+([\\S]+)\\s+([\\S]+)[\\s+|:]([\\S]+)\\s+([\\S]+)(\\s+([\\S]+)\\s+([\\S]+))?",
-            RegexOptions.Compiled);
+            "^([\\S]+)\\s+([\\S]+)\\s+([\\S]+)\\s+([\\S]+)\\s+([\\S]+)[\\s:]([\\S]+)\\s+([\\S]+)(?:([\\s:]([\\S]+))?\\s+([\\S]+))?\\s*$",
+        RegexOptions.Compiled);
+
 
         /// <summary>
         ///     Executes the OpenPortCollector on Linux. Calls out to the `ss` command and parses the output,