LEFT | RIGHT |
1 # -*- coding: utf-8 -*- | 1 # -*- coding: utf-8 -*- |
2 """Parser for the Google Chrome Cookie database.""" | 2 """Parser for the Google Chrome Cookie database.""" |
3 | 3 |
4 from dfdatetime import webkit_time as dfdatetime_webkit_time | 4 from dfdatetime import webkit_time as dfdatetime_webkit_time |
5 | 5 |
6 from plaso.containers import events | 6 from plaso.containers import events |
7 from plaso.containers import time_events | 7 from plaso.containers import time_events |
8 from plaso.lib import eventdata | 8 from plaso.lib import eventdata |
9 # Register the cookie plugins. | 9 # Register the cookie plugins. |
10 from plaso.parsers import cookie_plugins # pylint: disable=unused-import | 10 from plaso.parsers import cookie_plugins # pylint: disable=unused-import |
(...skipping 41 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
52 | 52 |
53 # Define the needed queries. | 53 # Define the needed queries. |
54 QUERIES = [ | 54 QUERIES = [ |
55 ((u'SELECT creation_utc, host_key, name, value, path, expires_utc, ' | 55 ((u'SELECT creation_utc, host_key, name, value, path, expires_utc, ' |
56 u'secure, httponly, last_access_utc, has_expires, persistent ' | 56 u'secure, httponly, last_access_utc, has_expires, persistent ' |
57 u'FROM cookies'), u'ParseCookieRow')] | 57 u'FROM cookies'), u'ParseCookieRow')] |
58 | 58 |
59 # The required tables common to Archived History and History. | 59 # The required tables common to Archived History and History. |
60 REQUIRED_TABLES = frozenset([u'cookies', u'meta']) | 60 REQUIRED_TABLES = frozenset([u'cookies', u'meta']) |
61 | 61 |
62 SCHEMAS = [ | 62 SCHEMAS = [{ |
63 {u'cookies': | 63 u'cookies': ( |
64 u'CREATE TABLE cookies (creation_utc INTEGER NOT NULL UNIQUE PRIMARY ' | 64 u'CREATE TABLE cookies (creation_utc INTEGER NOT NULL UNIQUE PRIMARY ' |
65 u'KEY,host_key TEXT NOT NULL,name TEXT NOT NULL,value TEXT NOT ' | 65 u'KEY, host_key TEXT NOT NULL, name TEXT NOT NULL, value TEXT NOT ' |
66 u'NULL,path TEXT NOT NULL,expires_utc INTEGER NOT NULL,secure INTEGER ' | 66 u'NULL, path TEXT NOT NULL, expires_utc INTEGER NOT NULL, secure ' |
67 u'NOT NULL,httponly INTEGER NOT NULL,last_access_utc INTEGER NOT ' | 67 u'INTEGER NOT NULL, httponly INTEGER NOT NULL, last_access_utc ' |
68 u'NULL, has_expires INTEGER DEFAULT 1, persistent INTEGER DEFAULT 1)', | 68 u'INTEGER NOT NULL, has_expires INTEGER DEFAULT 1, persistent ' |
69 u'meta': | 69 u'INTEGER DEFAULT 1)'), |
70 u'CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY,value ' | 70 u'meta': ( |
71 u'LONGVARCHAR)'}] | 71 u'CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY, ' |
| 72 u'value LONGVARCHAR)')}] |
72 | 73 |
73 # Point to few sources for URL information. | 74 # Point to few sources for URL information. |
74 URLS = [ | 75 URLS = [ |
75 u'http://src.chromium.org/svn/trunk/src/net/cookies/', | 76 u'http://src.chromium.org/svn/trunk/src/net/cookies/', |
76 (u'http://www.dfinews.com/articles/2012/02/' | 77 (u'http://www.dfinews.com/articles/2012/02/' |
77 u'google-analytics-cookies-and-forensic-implications')] | 78 u'google-analytics-cookies-and-forensic-implications')] |
78 | 79 |
79 # Google Analytics __utmz variable translation. | 80 # Google Analytics __utmz variable translation. |
80 # Taken from: | 81 # Taken from: |
81 # http://www.dfinews.com/sites/dfinews.com/files/u739/Tab2Cookies020312.jpg | 82 # http://www.dfinews.com/sites/dfinews.com/files/u739/Tab2Cookies020312.jpg |
(...skipping 74 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
156 parser_mediator, cookie_data=cookie_data, cookie_name=cookie_name, | 157 parser_mediator, cookie_data=cookie_data, cookie_name=cookie_name, |
157 url=url) | 158 url=url) |
158 | 159 |
159 except Exception as exception: # pylint: disable=broad-except | 160 except Exception as exception: # pylint: disable=broad-except |
160 parser_mediator.ProduceExtractionError( | 161 parser_mediator.ProduceExtractionError( |
161 u'plugin: {0:s} unable to parse cookie with error: {1:s}'.format( | 162 u'plugin: {0:s} unable to parse cookie with error: {1:s}'.format( |
162 plugin.NAME, exception)) | 163 plugin.NAME, exception)) |
163 | 164 |
164 | 165 |
165 sqlite.SQLiteParser.RegisterPlugin(ChromeCookiePlugin) | 166 sqlite.SQLiteParser.RegisterPlugin(ChromeCookiePlugin) |
LEFT | RIGHT |