Improve registry value return types

Specifically:
- REG_MULTI_SZ returns list<string> instead of | str join (char nl)
- REG_EXPAND_SZ automatically expands %EnvironmentString% placeholders
- REG_DWORD_BIG_ENDIAN returns the endianness decoded value
- REG_QWORD actually ingests values over 2**32
- REG_LINK produces a decoded string
- REG_*RESOURCE* produces binary data
This commit is contained in:
Christopher Durham 2023-10-22 00:24:54 -04:00
parent a01ef85bda
commit 0c5a4c991f
2 changed files with 112 additions and 60 deletions

View File

@ -110,6 +110,7 @@ version = "3.1"
features = [
"Win32_Foundation",
"Win32_Storage_FileSystem",
"Win32_System_Environment",
"Win32_System_SystemServices",
"Win32_Security",
"Win32_System_Threading",

View File

@ -5,7 +5,8 @@ use nu_protocol::{
record, Category, Example, IntoInterruptiblePipelineData, IntoPipelineData, PipelineData,
ShellError, Signature, Span, Spanned, SyntaxShape, Type, Value,
};
use winreg::{enums::*, RegKey};
use windows::{core::PCWSTR, Win32::System::Environment::ExpandEnvironmentStringsW};
use winreg::{enums::*, types::FromRegValue, RegKey};
#[derive(Clone)]
pub struct RegistryQuery;
@ -92,12 +93,13 @@ fn registry_query(
if registry_value.is_none() {
let mut reg_values = vec![];
for (name, val) in reg_key.enum_values().flatten() {
let (nu_value, reg_type) = reg_value_to_nu_value(val, call_span);
let reg_type = format!("{:?}", val.vtype);
let nu_value = reg_value_to_nu_value(val, call_span);
reg_values.push(Value::record(
record! {
"name" => Value::string(name, call_span),
"value" => nu_value,
"type" => Value::string(format!("{:?}", reg_type), call_span),
"type" => Value::string(reg_type, call_span),
},
*registry_key_span,
))
@ -109,12 +111,13 @@ fn registry_query(
let reg_value = reg_key.get_raw_value(value.item.as_str());
match reg_value {
Ok(val) => {
let (nu_value, reg_type) = reg_value_to_nu_value(val, call_span);
let reg_type = format!("{:?}", val.vtype);
let nu_value = reg_value_to_nu_value(val, call_span);
Ok(Value::record(
record! {
"name" => Value::string(value.item, call_span),
"value" => nu_value,
"type" => Value::string(format!("{:?}", reg_type), call_span),
"type" => Value::string(reg_type, call_span),
},
value.span,
)
@ -174,61 +177,109 @@ fn get_reg_hive(call: &Call) -> Result<RegKey, ShellError> {
Ok(RegKey::predef(hkey))
}
fn reg_value_to_nu_value(
reg_value: winreg::RegValue,
call_span: Span,
) -> (nu_protocol::Value, winreg::enums::RegType) {
fn reg_value_to_nu_value(mut reg_value: winreg::RegValue, call_span: Span) -> nu_protocol::Value {
match reg_value.vtype {
REG_NONE => (Value::nothing(call_span), reg_value.vtype),
REG_SZ => (
Value::string(reg_value.to_string(), call_span),
reg_value.vtype,
),
REG_EXPAND_SZ => (
Value::string(reg_value.to_string(), call_span),
reg_value.vtype,
),
REG_BINARY => (Value::binary(reg_value.bytes, call_span), reg_value.vtype),
REG_DWORD => (
Value::int(
unsafe { *(reg_value.bytes.as_ptr() as *const u32) } as i64,
call_span,
),
reg_value.vtype,
),
REG_DWORD_BIG_ENDIAN => (
Value::int(
unsafe { *(reg_value.bytes.as_ptr() as *const u32) } as i64,
call_span,
),
reg_value.vtype,
),
REG_LINK => (
Value::string(reg_value.to_string(), call_span),
reg_value.vtype,
),
REG_MULTI_SZ => (
Value::string(reg_value.to_string(), call_span),
reg_value.vtype,
),
REG_RESOURCE_LIST => (
Value::string(reg_value.to_string(), call_span),
reg_value.vtype,
),
REG_FULL_RESOURCE_DESCRIPTOR => (
Value::string(reg_value.to_string(), call_span),
reg_value.vtype,
),
REG_RESOURCE_REQUIREMENTS_LIST => (
Value::string(reg_value.to_string(), call_span),
reg_value.vtype,
),
REG_QWORD => (
Value::int(
unsafe { *(reg_value.bytes.as_ptr() as *const u32) } as i64,
call_span,
),
reg_value.vtype,
),
REG_NONE => Value::nothing(call_span),
REG_BINARY => Value::binary(reg_value.bytes, call_span),
REG_MULTI_SZ => reg_value_to_nu_list_string(reg_value, call_span),
REG_SZ | REG_EXPAND_SZ => reg_value_to_nu_string(reg_value, call_span),
REG_DWORD | REG_DWORD_BIG_ENDIAN | REG_QWORD => reg_value_to_nu_int(reg_value, call_span),
// This should be impossible, as registry symlinks should be automatically transparent
// to the registry API as it's used by winreg, since it never uses REG_OPTION_OPEN_LINK.
// If it happens, decode as if the link is a string; it should be a registry path string.
REG_LINK => {
reg_value.vtype = REG_SZ;
reg_value_to_nu_string(reg_value, call_span)
}
// Decode these as binary; that seems to be the least bad option available to us.
// REG_RESOURCE_LIST is a struct CM_RESOURCE_LIST.
// REG_FULL_RESOURCE_DESCRIPTOR is a struct CM_FULL_RESOURCE_DESCRIPTOR.
// REG_RESOURCE_REQUIREMENTS_LIST is a struct IO_RESOURCE_REQUIREMENTS_LIST.
REG_RESOURCE_LIST | REG_FULL_RESOURCE_DESCRIPTOR | REG_RESOURCE_REQUIREMENTS_LIST => {
reg_value.vtype = REG_BINARY;
Value::binary(reg_value.bytes, call_span)
}
}
}
fn reg_value_to_nu_string(reg_value: winreg::RegValue, call_span: Span) -> nu_protocol::Value {
let value = String::from_reg_value(&reg_value)
.expect("registry value type should be REG_SZ or REG_EXPAND_SZ");
// REG_EXPAND_SZ contains unexpanded references to environment variables, for example, %PATH%.
// winreg not expanding these is arguably correct, as it's just wrapping raw registry access.
// These placeholder-having strings work in *some* Windows contexts, but Rust's fs/path APIs
// don't handle them, so they won't work in Nu unless we expand them here. Eagerly expanding the
// strings here seems to be the least bad option. This is what PowerShell does, for example,
// although reg.exe does not. We could do the substitution with our env, but the officially
// correct way to expand these strings is to call Win32's ExpandEnvironmentStrings function.
// ref: <https://learn.microsoft.com/en-us/windows/win32/sysinfo/registry-value-types>
// We can skip the dance if the string doesn't actually have any unexpanded placeholders.
if reg_value.vtype != REG_EXPAND_SZ || !value.contains('%') {
return Value::string(value, call_span);
}
// The encoding dance is unfortunate since we read "Windows Unicode" from the registry, but
// it's the most resilient option and avoids making potentially wrong alignment assumptions.
let value_utf16 = value.encode_utf16().chain([0]).collect::<Vec<u16>>();
// Like most Win32 string functions, the return value is the number of TCHAR written,
// or the required buffer size (in TCHAR) if the buffer is too small, or 0 for error.
// Since we already checked for the case where no expansion is done, we can start with
// an empty output buffer, since we expect to require at least one resize loop anyway.
let mut out_buffer = vec![];
loop {
match unsafe {
ExpandEnvironmentStringsW(PCWSTR(value_utf16.as_ptr()), Some(&mut *out_buffer))
} {
0 => {
// 0 means error, but we don't know what the error is. We could try to get
// the error code with GetLastError, but that's a whole other can of worms.
// Instead, we'll just return the original string and hope for the best.
// Presumably, registry strings shouldn't ever cause this to error anyway.
return Value::string(value, call_span);
}
size if size as usize <= out_buffer.len() => {
// The buffer was large enough, so we're done. Remember to remove the trailing nul!
let out_value_utf16 = &out_buffer[..size as usize - 1];
let out_value = String::from_utf16_lossy(out_value_utf16);
return Value::string(out_value, call_span);
}
size => {
// The buffer was too small, so we need to resize and try again.
// Clear first to indicate we don't care about the old contents.
out_buffer.clear();
out_buffer.resize(size as usize, 0);
continue;
}
}
}
}
fn reg_value_to_nu_list_string(reg_value: winreg::RegValue, call_span: Span) -> nu_protocol::Value {
let values = <Vec<String>>::from_reg_value(&reg_value)
.expect("registry value type should be REG_MULTI_SZ")
.into_iter()
.map(|s| Value::string(s, call_span));
// There's no REG_MULTI_EXPAND_SZ, so no need to do placeholder expansion here.
Value::list(values.collect(), call_span)
}
fn reg_value_to_nu_int(reg_value: winreg::RegValue, call_span: Span) -> nu_protocol::Value {
let value = match reg_value.vtype {
REG_DWORD => u32::from_reg_value(&reg_value).unwrap() as i64,
REG_DWORD_BIG_ENDIAN => {
// winreg (v0.51.0) doesn't natively decode REG_DWORD_BIG_ENDIAN
u32::from_be_bytes(unsafe { *reg_value.bytes.as_ptr().cast() }) as i64
}
REG_QWORD => u64::from_reg_value(&reg_value).unwrap() as i64,
_ => unreachable!(
"registry value type should be REG_DWORD, REG_DWORD_BIG_ENDIAN, or REG_QWORD"
),
};
Value::int(value, call_span)
}