From 8785899080e4fe28e61fece148e170697a3542c4 Mon Sep 17 00:00:00 2001 From: Mike Auty Date: Thu, 21 Nov 2024 22:51:59 +0000 Subject: [PATCH] Only remove a file URL with no host and a non-existant path --- volatility3/framework/automagic/symbol_cache.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/automagic/symbol_cache.py b/volatility3/framework/automagic/symbol_cache.py index 1b8cc7422..5541d552e 100644 --- a/volatility3/framework/automagic/symbol_cache.py +++ b/volatility3/framework/automagic/symbol_cache.py @@ -313,7 +313,12 @@ class SqliteCache(CacheManagerInterface): # Missing entries if missing_locations: for missing_location in missing_locations: - if not os.path.exists(missing_location): + parsed_url = urllib.parse(missing_location) + if ( + parsed_url.scheme == "file" + and parsed_url.host == "" + and not os.path.exists(parsed_url.path) + ): self._database.cursor().execute( f"DELETE FROM cache WHERE location IN ({','.join(['?'] * len(missing_locations))})", [x for x in missing_locations],