Repository: mandiant/capa
File: capa/main.py (Python)

Code before:
    capabilities: MatchResults
    counts: Dict[str, Any]

    if input_format == FORMAT_RESULT:
        # result document directly parses into meta, capabilities
        result_doc = capa.render.result_document.ResultDocument.from_file(args.input_file)
        meta, capabilities = result_doc.to_capa()

    else:
        # all other formats we must create an extractor
        # and use that to extract meta and capabilities

        try:
            backend = get_backend_from_cli(args, input_format)
            sample_path = get_sample_path_from_cli(args, backend)
            if sample_path is None:
                os_ = "unknown"
            else:
                os_ = capa.loader.get_os(sample_path)
            extractor = get_extractor_from_cli(args, input_format, backend)
        except ShouldExitError as e:
            return e.status_code

        if any(extractor_filters.values()):
            # if the user specified any extractor filters, apply them here.
            extractor = apply_extractor_filters(extractor, extractor_filters)

        capabilities, counts = find_capabilities(rules, extractor, disable_progress=args.quiet)

        meta = capa.loader.collect_metadata(argv, args.input_file, input_format, os_, args.rules, extractor, counts)
        meta.analysis.layout = capa.loader.compute_layout(rules, extractor, capabilities)

        if isinstance(extractor, StaticFeatureExtractor) and found_file_limitation:
            # bail if capa's static feature extractor encountered file limitation e.g. a packed binary
            # do show the output in verbose mode, though.
            if not (args.verbose or args.vverbose or args.json):
                return E_FILE_LIMITATION

    if args.json:
        print(capa.render.json.render(meta, rules, capabilities))
    elif args.vverbose:
        print(capa.render.vverbose.render(meta, rules, capabilities))
    elif args.verbose:
        print(capa.render.verbose.render(meta, rules, capabilities))
    else:
        print(capa.render.default.render(meta, rules, capabilities))
    colorama.deinit()

    logger.debug("done.")

    return 0

Review comment (refactor):
i think this should be moved within `get_extractor_from_cli` so that all callers benefit from this filtering capability

Code after:
        },
    )
    parser.add_argument("-j", "--json", action="store_true", help="emit JSON instead of text")
    args = parser.parse_args(args=argv)

    try:
        handle_common_args(args)
        ensure_input_exists_from_cli(args)
        input_format = get_input_format_from_cli(args)
        rules = get_rules_from_cli(args)
        file_extractors = get_file_extractors_from_cli(args, input_format)
        found_file_limitation = find_file_limitations_from_cli(args, rules, file_extractors)
    except ShouldExitError as e:
        return e.status_code

    meta: rdoc.Metadata
    capabilities: MatchResults
    counts: Dict[str, Any]

    if input_format == FORMAT_RESULT:
        # result document directly parses into meta, capabilities
        result_doc = capa.render.result_document.ResultDocument.from_file(args.input_file)
        meta, capabilities = result_doc.to_capa()

    else:
        # all other formats we must create an extractor
        # and use that to extract meta and capabilities

        try:
            backend = get_backend_from_cli(args, input_format)
            sample_path = get_sample_path_from_cli(args, backend)
            if sample_path is None:
                os_ = "unknown"
            else:
                os_ = capa.loader.get_os(sample_path)
            extractor = get_extractor_from_cli(args, input_format, backend)
        except ShouldExitError as e:
            return e.status_code

        capabilities, counts = find_capabilities(rules, extractor, disable_progress=args.quiet)

        meta = capa.loader.collect_metadata(argv, args.input_file, input_format, os_, args.rules, extractor, counts)
        meta.analysis.layout = capa.loader.compute_layout(rules, extractor, capabilities)

        if isinstance(extractor, StaticFeatureExtractor) and found_file_limitation:
            # bail if capa's static feature extractor encountered file limitation e.g. a packed binary
            # do show the output in verbose mode, though.
            if not (args.verbose or args.vverbose or args.json):
                return E_FILE_LIMITATION

    if args.json: