fix: single loader ignored path components

dissect/target/loaders/single.py

@@ -22,9 +22,11 @@ def detect(_: Path) -> bool:
         return False
 
     def map(self, target: Target) -> None:
+        """Maps the contents of the target path recursively into a special drop folder"""
+
         vfs = VirtualFilesystem(case_sensitive=False, alt_separator=target.fs.alt_separator)
         target.filesystems.add(vfs)
         target.fs.mount("/", vfs)
         for entry in self.path.parent.glob(self.path.name):
-            mapping = str(vfs.path(SINGLE_FILE_DIR).joinpath(entry.name))
-            vfs.map_file(mapping, str(entry))
+            mapping = vfs.path(SINGLE_FILE_DIR).joinpath(entry.name)
+            vfs.map_file(str(mapping), str(entry))

dissect/target/plugins/os/windows/log/evt.py

@@ -200,8 +200,7 @@ def _parse_chunk(self, _, chunk: bytes) -> Iterator[Record]:
     def _get_files(self, logs_dir: str | None, log_file_glob: str | None = "*") -> Iterable[Path]:
         if self.single_file_mode:
             return self.get_drop_files()
-
-        if logs_dir:
+        elif logs_dir:
             return self.get_logs_from_dir(logs_dir, filename_glob=log_file_glob)
-        else:
-            return self.get_logs(filename_glob=log_file_glob)
+
+        return self.get_logs(filename_glob=log_file_glob)

dissect/target/plugins/os/windows/log/evtx.py

@@ -158,11 +158,10 @@ def _create_event_descriptor(self, record_fields) -> TargetRecordDescriptor:
     def _get_files(self, logs_dir: str | None, log_file_glob: str | None = "*") -> Iterable[Path]:
         if self.single_file_mode:
             return self.get_drop_files()
-
-        if logs_dir:
+        elif logs_dir:
             return self.get_logs_from_dir(logs_dir, filename_glob=log_file_glob)
-        else:
-            return self.get_logs(filename_glob=log_file_glob)
+
+        return self.get_logs(filename_glob=log_file_glob)
 
 
 def format_value(value: Any) -> Any:

tests/loaders/test_single.py

@@ -0,0 +1,16 @@
+import io
+from pathlib import Path
+
+from dissect.target import Target
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.loaders.single import SingleFileLoader
+
+
+def test_single_loader(target_default: Target) -> None:
+    path = Path("test/single.txt")
+    vfs = VirtualFilesystem()
+    vfs.map_file_fh("test/single.txt", io.BytesIO(b"\x00"))
+    log_loader = SingleFileLoader(vfs.path(path))
+    log_loader.map(target_default)
+
+    assert target_default.fs.exists("$drop$/single.txt")

tests/tools/test_query.py

@@ -300,33 +300,6 @@ def get_plugin(plugins: list[dict], needle: str) -> dict:
     }
 
 
-def test_target_query_single_file_supported(monkeypatch: pytest.MonkeyPatch) -> None:
-    """test if target-query can execute a plugin in single file mode if supported."""
-
-    with monkeypatch.context() as m:
-        m.setattr(
-            "sys.argv",
-            [
-                "target-query",
-                "-f",
-                "authlog",
-                "--single-file",
-                "tests/_data/plugins/os/windows/log/schedlgu/schedlgu.txt",
-            ],
-        )
-
-        with (
-            patch(
-                "dissect.target.tools.query.execute_function_on_target",
-                autospec=True,
-                side_effect=mock_execute_function,
-            ) as mock_execute,
-        ):
-            target_query()
-
-            assert len(mock_execute.mock_calls) == 1
-
-
 def test_target_query_single_file_unsupported(capsys: pytest.CaptureFixture, monkeypatch: pytest.MonkeyPatch) -> None:
     """test if target-query prints an error if a plugin does not support single file mode."""