awatch-rus/AWatch-rus
1
0
Fork 0
Code Issues Pull Requests Actions 100 Packages Projects Releases Wiki Activity

Merge pull request #7 from igor04091968/codex/find-and-fix-error-in-powershell-dlp-script

Browse Source 
Refine detection of masked Cyrillic print titles and normalize printer names
This commit is contained in:
IgorRachkov
2026-05-07 07:31:50 +03:00
committed by GitHub
parent 5a89a79803 8f10bef904
commit 66a8c47319
2 changed files with 26 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
install-kit-awindows-20260427-211240/windows/dlp-endpoint-signals-collector.ps1
+13 -2
View File
@@ -516,6 +516,17 @@ function Test-LooksLikeMojibakeQuestionMarks {
return $Value -match '\?{2,}'
}
function Test-LooksLikeRussianTitleMaskedAsQuestionMarks {
param([AllowNull()][string]$Value)
if ([string]::IsNullOrWhiteSpace($Value)) { return $false }
$trimmed = $Value.Trim()
if ($trimmed -match '[A-Za-zА-Яа-я0-9]') { return $false }
# Typical broken Cyrillic print title shape: multiple words of question marks.
return $trimmed -match '^\?{3,}(\s+\?{3,})+$'
}
function Normalize-OwnerForMatch {
param([AllowNull()][string]$Value)
if ([string]::IsNullOrWhiteSpace($Value)) { return '' }
@@ -823,12 +834,12 @@ while ($true) {
if ($script:SeenPrintJob.ContainsKey($jobId)) { continue }
$script:SeenPrintJob[$jobId] = (Get-Date).ToUniversalTime()
$printerName = [string]$job.Name
$printerName = Normalize-PrinterForMatch -Value ([string]$job.Name)
$documentName = [string]$job.Document
$owner = [string]$job.Owner
$documentNameOriginal = $documentName
if (Test-LooksLikeMojibakeQuestionMarks -Value $documentName) {
if (Test-LooksLikeRussianTitleMaskedAsQuestionMarks -Value $documentName) {
$eventDocumentName = Get-BetterDocumentNameFromPrintServiceEvents -Owner $owner -PrinterName $printerName
if ($eventDocumentName) {
$documentName = $eventDocumentName
windows/dlp-endpoint-signals-collector.ps1
+13 -2
View File
@@ -578,6 +578,17 @@ function Test-LooksLikeMojibakeQuestionMarks {
return $Value -match '\?{2,}'
}
function Test-LooksLikeRussianTitleMaskedAsQuestionMarks {
param([AllowNull()][string]$Value)
if ([string]::IsNullOrWhiteSpace($Value)) { return $false }
$trimmed = $Value.Trim()
if ($trimmed -match '[A-Za-zА-Яа-я0-9]') { return $false }
# Typical broken Cyrillic print title shape: multiple words of question marks.
return $trimmed -match '^\?{3,}(\s+\?{3,})+$'
}
function Normalize-OwnerForMatch {
param([AllowNull()][string]$Value)
if ([string]::IsNullOrWhiteSpace($Value)) { return '' }
@@ -892,12 +903,12 @@ while ($true) {
if ($script:SeenPrintJob.ContainsKey($jobId)) { continue }
$script:SeenPrintJob[$jobId] = (Get-Date).ToUniversalTime()
$printerName = [string]$job.Name
$printerName = Normalize-PrinterForMatch -Value ([string]$job.Name)
$documentName = [string]$job.Document
$owner = [string]$job.Owner
$documentNameOriginal = $documentName
if (Test-LooksLikeMojibakeQuestionMarks -Value $documentName) {
if (Test-LooksLikeRussianTitleMaskedAsQuestionMarks -Value $documentName) {
$eventDocumentName = Get-BetterDocumentNameFromPrintServiceEvents -Owner $owner -PrinterName $printerName
if ($eventDocumentName) {
$documentName = $eventDocumentName