From 215b460a2e3c832265b60fda3d6102779ec4d0a1 Mon Sep 17 00:00:00 2001 From: Janik Besendorf Date: Sun, 11 Oct 2026 14:40:25 +0200 Subject: [PATCH] Preserve relative path indicator matches for iOS artifacts --- src/mvt/ios/paths.py | 3 ++- tests/test_ios_coruna.py | 4 ++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/src/mvt/ios/paths.py b/src/mvt/ios/paths.py index b1fbfc86..d5a89916 100644 --- a/src/mvt/ios/paths.py +++ b/src/mvt/ios/paths.py @@ -43,4 +43,5 @@ def check_ios_path(indicators: Indicators, path: str) -> Optional[IndicatorMatch match = indicators.check_file_path(candidate) if match: return match - return None + # Filesystem records and existing indicators may both use relative paths. + return indicators.check_file_path(posixpath.normpath(path.replace("\\", "/"))) diff --git a/tests/test_ios_coruna.py b/tests/test_ios_coruna.py index a2aa9293..feb75e2e 100644 --- a/tests/test_ios_coruna.py +++ b/tests/test_ios_coruna.py @@ -187,6 +187,10 @@ def test_path_only_alert_is_medium(): ("/var/tmp/ioslab_ctl", "private\\var\\tmp\\ioslab_ctl", True), ("/var/tmp/ioslab_ctl", "/var/tmp/ioslab_ctl2", False), ("/private/var/tmp/.ghost_upper/", "/var/tmp/.ghost_upper-copy/file", False), + ("matched/directory", "matched/directory/file", True), + ("matched/directory", "matched\\directory\\file", True), + ("matched/directory", "matched/directory-copy/file", False), + ("matched/directory", "matched/directory/../other/file", False), ], ) def test_ios_path_iocs_respect_aliases_and_boundaries(ioc, path, expected):