Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

objectifying XML pkt of multiple "field" tags with the same "name" attribute #23

Closed
nwohaibi opened this issue Apr 22, 2014 · 4 comments

Comments

@nwohaibi
Copy link

Hi,

https://github.com/KimiNewt/pyshark/blob/master/src/pyshark/packet/layer.py#L43

for field in xml_obj.findall('.//field'):
            self._all_fields[field.attrib['name']] = LayerField(**dict(field.attrib))

I was wondering whats the proper parsing/objectifying of XML packet of multiple "field" tags with the same attribute "name"?
The issue occurs mostly in the highest decoded layer of the packet e.g. DATA-LINES-TEXT, where multiple "field" tags have an empty "name" attribute.

If I may recommend something, (without breaking backward compatibility), adding a prefix to duplicated names e.g. "name_attribute", "name_attribute_1", "name_attribute_2" ..etc

PS
thanks for such a great project

@nwohaibi
Copy link
Author

maybe something dirty like this..


for field in xml_obj.findall('.//field'):
    if field.attrib['name'] in self._all_fields:
        temp_dict_of_attrs = dict(field.attrib)
        if self._all_fields[field.attrib['name']].value is not None and "value" in temp_dict_of_attrs: 
            if temp_dict_of_attrs["value"]:
                self._all_fields[field.attrib['name']].value += temp_dict_of_attrs["value"]
        if self._all_fields[field.attrib['name']].show is not None and "show" in temp_dict_of_attrs: 
            if temp_dict_of_attrs["show"]:
                if temp_dict_of_attrs["show"].find("[truncated]") == 0:
                    temp_dict_of_attrs["show"] = temp_dict_of_attrs["show"][11:]
                self._all_fields[field.attrib['name']].show += temp_dict_of_attrs["show"]
        if self._all_fields[field.attrib['name']].size is not None and "size" in temp_dict_of_attrs: 
            if temp_dict_of_attrs["size"]:
                self._all_fields[field.attrib['name']].size += temp_dict_of_attrs["size"]
    else:
        self._all_fields[field.attrib['name']] = LayerField(**dict(field.attrib))
        if self._all_fields[field.attrib['name']].show:
            if self._all_fields[field.attrib['name']].show.find("[truncated]") == 0:
                self._all_fields[field.attrib['name']].show = self._all_fields[field.attrib['name']].show[11:]

@nwohaibi
Copy link
Author

anyone working on this?
if not, I might have the time to patch it properly.

@KimiNewt
Copy link
Owner

I haven't had time to think of an actually good solution, if you have anything - please do

@KimiNewt
Copy link
Owner

Finally solved on #46

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants