From 9c7353a2e91a77e9f90dcb16e93019406bd78746 Mon Sep 17 00:00:00 2001
From: DustInDark <nextsasasa@gmail.com>
Date: Thu, 13 Jan 2022 22:19:59 +0900
Subject: [PATCH] Feature/except hidden file#335 (#339)

* added except hidden file load #335

* fixed except hidden file in collect evtx #335
---
 src/main.rs | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/src/main.rs b/src/main.rs
index 18400a3a..dccca891 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -19,6 +19,7 @@ use hhmmss::Hhmmss;
 use pbr::ProgressBar;
 use serde_json::Value;
 use std::collections::{HashMap, HashSet};
+use std::ffi::OsStr;
 use std::fmt::Display;
 use std::io::BufWriter;
 use std::path::Path;
@@ -99,10 +100,18 @@ impl App {
             println!("");
         }
         if let Some(filepath) = configs::CONFIG.read().unwrap().args.value_of("filepath") {
-            if !filepath.ends_with(".evtx") {
+            if !filepath.ends_with(".evtx")
+                || Path::new(filepath)
+                    .file_stem()
+                    .unwrap_or(OsStr::new("."))
+                    .to_str()
+                    .unwrap()
+                    .trim()
+                    .starts_with(".")
+            {
                 AlertMessage::alert(
                     &mut BufWriter::new(std::io::stderr().lock()),
-                    &"--filepath only accepts .evtx files.".to_string(),
+                    &"--filepath only accepts .evtx files. no hidden file.".to_string(),
                 )
                 .ok();
                 return;
@@ -171,7 +180,14 @@ impl App {
                 });
             } else {
                 let path_str = path.to_str().unwrap_or("");
-                if path_str.ends_with(".evtx") {
+                if path_str.ends_with(".evtx")
+                    && !Path::new(path_str)
+                        .file_stem()
+                        .unwrap_or(OsStr::new("."))
+                        .to_str()
+                        .unwrap()
+                        .starts_with(".")
+                {
                     ret.push(path);
                 }
             }