Skip to content

Search for additional command history on Citrix systems #1501

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JSCU-CNI wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Search for additional command history on Citrix systems #1501

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
adbdd2b
Fix for #1500
JSCU-CNI Jan 15, 2026
37540f4
Do not extend citrix history files with regular history files as the …
JSCU-CNI Jan 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions dissect/target/plugins/os/unix/bsd/citrix/history.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,8 +69,6 @@ def _find_history_files(self) -> list[tuple[str, TargetPath, UnixUserRecord | No
(shell, path, None) for path in self.target.fs.path("/").glob(history_absolute_path_glob.lstrip("/"))
)

# Also utilize the _find_history_files function of the parent class
history_files.extend(super()._find_history_files())
Comment on lines -72 to -73
Copy link
Member

@Schamper Schamper Jan 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would you mind adding a unit test? Wouldn't removing this stop the other files from being iterated in the super commandhistory? And the Citrix files to be yielded doubly because of parse_generic_history?

return history_files

def _find_user_by_name(self, username: str) -> UnixUserRecord | None:
Expand All @@ -95,6 +93,9 @@ def commandhistory(self) -> Iterator[CommandHistoryRecord]:
elif shell in ("citrix-netscaler-bash", "citrix-netscaler-sh"):
yield from self.parse_netscaler_bash_history(history_path)

# Search for additional command history in regular UNIX-like history files.
yield from super().commandhistory()

def parse_netscaler_bash_history(self, path: TargetPath) -> Iterator[CommandHistoryRecord]:
"""Parse bash.log* contents."""

Expand Down