Analysis plugin nsrlsvr: KeyError in plaso/analysis/interface.py

Plaso version:

1.5.0 Release

Operating system Plaso is running on:

XUbuntu 64 bit

Installation method:

Installed from GiFT

Description of problem:

Tagging events using the --analysis nsrlsvr option throws an exception.

Debug output/tracebacks:

The following error is shown in the debug log:

[ERROR] (nsrlsvr   ) PID:XXXXX <analysis_process> <dfvfs.path.os_path_spec.OSPathSpec object at 0xXXXXXXXXXXXX>
Traceback (most recent call last):                                                                                                     
  File "/usr/lib/python2.7/dist-packages/plaso/multi_processing/analysis_process.py", line 138, in _Main                               
    self._analysis_mediator.ProduceAnalysisReport(self._analysis_plugin)                                                               
  File "/usr/lib/python2.7/dist-packages/plaso/analysis/mediator.py", line 95, in ProduceAnalysisReport                                
    analysis_report = plugin.CompileReport(self)                                                                                       
  File "/usr/lib/python2.7/dist-packages/plaso/analysis/interface.py", line 280, in CompileReport                                      
    hash_analysis)                                                                                                                     
  File "/usr/lib/python2.7/dist-packages/plaso/analysis/interface.py", line 187, in _HandleHashAnalysis                                
    event_uuids = self._event_uuids_by_pathspec.pop(pathspec)                                                                          
KeyError: <dfvfs.path.os_path_spec.OSPathSpec object at 0xXXXXXXXXXXXX>

Source data:

The exception is caused by popping from _event_uuids_by_pathspec. This is a defaultdict, so retrieving an unexisting entry from the dict using the key would be no problem. A pop() is, though.

Problem can be fixed by catching a KeyError on line 187 of plaso/analysis/interface.py and set event_uuids to an empty list.

  try:
    event_uuids = self._event_uuids_by_pathspec.pop(pathspec)
  except KeyError:
    event_uuids = []

[joachimmetz]

https://codereview.appspot.com/312850043/

[joachimmetz]

changes merged