# Copyright 2020 FireEye, Inc. and Citrix Systems, Inc.

# FreeBSD/NetScaler bash doesn't support array declaration shortcut
# so we create the array by hand... I'm sorry.
declare -a cron_history_blacklist;
cron_history_blacklist[0]="185.178.45.221"
cron_history_blacklist[1]="62.113.112.33"
cron_history_blacklist[2]="ci.sh"
cron_history_blacklist[3]="ci2.sh"
cron_history_blacklist[4]="ci3.sh"
# anything by the user `nobody`
cron_history_blacklist[5]="(nobody) CMD"

declare -a cron_history_paths;
cron_history_paths[0]="/var/log/cron";

scan_cron_history() {
    for path in "${cron_history_paths[@]}"; do
        if  ! compgen -G "$root_directory/$path*" >/dev/null; then
            debug "didn't find $path files";
            continue;
        fi

        local found=false;
        for re in "${cron_history_blacklist[@]}"; do
            # /dev/null to ensure at least one of these files exists so zgrep doesn't fail
            local entries=$(zgrep -F "$re" "$root_directory/$path"* /dev/null);
            if [ -n "$entries" ]; then
                found=true;
                report_match "blacklisted content '$re'";
                report "matches for '$re':";
                report "$entries";
            fi
        done

        if [ "$found" != true ]; then
            debug "did not find blacklisted content in $path";
        fi
    done
}