LEFT | RIGHT |
1 # -*- coding: utf-8 -*- | 1 # -*- coding: utf-8 -*- |
2 """Parser for the Google Chrome Cookie database.""" | 2 """Parser for the Google Chrome Cookie database.""" |
3 | 3 |
4 from __future__ import unicode_literals | 4 from __future__ import unicode_literals |
5 | 5 |
6 from dfdatetime import webkit_time as dfdatetime_webkit_time | 6 from dfdatetime import webkit_time as dfdatetime_webkit_time |
7 | 7 |
8 from plaso.containers import events | 8 from plaso.containers import events |
9 from plaso.containers import time_events | 9 from plaso.containers import time_events |
10 from plaso.lib import definitions | 10 from plaso.lib import definitions |
(...skipping 85 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
96 cookie_plugins_manager.CookiePluginsManager.GetPlugins()) | 96 cookie_plugins_manager.CookiePluginsManager.GetPlugins()) |
97 | 97 |
98 def ParseCookieRow(self, parser_mediator, row, query=None, **unused_kwargs): | 98 def ParseCookieRow(self, parser_mediator, row, query=None, **unused_kwargs): |
99 """Parses a cookie row. | 99 """Parses a cookie row. |
100 | 100 |
101 Args: | 101 Args: |
102 parser_mediator (ParserMediator): parser mediator. | 102 parser_mediator (ParserMediator): parser mediator. |
103 row (sqlite3.Row): row resulting from the query. | 103 row (sqlite3.Row): row resulting from the query. |
104 query (Optional[str]): query string. | 104 query (Optional[str]): query string. |
105 """ | 105 """ |
106 # Note that pysqlite does not accept a Unicode string in row['string'] and | 106 query_hash = hash(query) |
107 # will raise "IndexError: Index must be int or string". | |
108 | 107 |
109 cookie_name = row['name'] | 108 cookie_name = self._GetRowValue(query_hash, row, 'name') |
110 cookie_data = row['value'] | 109 cookie_data = self._GetRowValue(query_hash, row, 'value') |
111 | 110 |
112 hostname = row['host_key'] | 111 hostname = self._GetRowValue(query_hash, row, 'host_key') |
113 if hostname.startswith('.'): | 112 if hostname.startswith('.'): |
114 hostname = hostname[1:] | 113 hostname = hostname[1:] |
115 | 114 |
116 if row['secure']: | 115 httponly = self._GetRowValue(query_hash, row, 'httponly') |
| 116 path = self._GetRowValue(query_hash, row, 'path') |
| 117 persistent = self._GetRowValue(query_hash, row, 'persistent') |
| 118 secure = self._GetRowValue(query_hash, row, 'secure') |
| 119 |
| 120 if secure: |
117 scheme = 'https' | 121 scheme = 'https' |
118 else: | 122 else: |
119 scheme = 'http' | 123 scheme = 'http' |
120 | 124 |
121 url = '{0:s}://{1:s}{2:s}'.format(scheme, hostname, row['path']) | 125 url = '{0:s}://{1:s}{2:s}'.format(scheme, hostname, path) |
122 | 126 |
123 event_data = ChromeCookieEventData() | 127 event_data = ChromeCookieEventData() |
124 event_data.cookie_name = cookie_name | 128 event_data.cookie_name = cookie_name |
125 event_data.data = cookie_data | 129 event_data.data = cookie_data |
126 event_data.host = hostname | 130 event_data.host = hostname |
127 event_data.httponly = True if row['httponly'] else False | 131 event_data.httponly = bool(httponly) |
128 event_data.path = row['path'] | 132 event_data.path = path |
129 event_data.persistent = True if row['persistent'] else False | 133 event_data.persistent = bool(persistent) |
130 event_data.query = query | 134 event_data.query = query |
131 event_data.secure = True if row['secure'] else False | 135 event_data.secure = bool(secure) |
132 event_data.url = url | 136 event_data.url = url |
133 | 137 |
134 timestamp = row['creation_utc'] | 138 timestamp = self._GetRowValue(query_hash, row, 'creation_utc') |
135 date_time = dfdatetime_webkit_time.WebKitTime(timestamp=timestamp) | 139 date_time = dfdatetime_webkit_time.WebKitTime(timestamp=timestamp) |
136 event = time_events.DateTimeValuesEvent( | 140 event = time_events.DateTimeValuesEvent( |
137 date_time, definitions.TIME_DESCRIPTION_CREATION) | 141 date_time, definitions.TIME_DESCRIPTION_CREATION) |
138 parser_mediator.ProduceEventWithEventData(event, event_data) | 142 parser_mediator.ProduceEventWithEventData(event, event_data) |
139 | 143 |
140 timestamp = row['last_access_utc'] | 144 timestamp = self._GetRowValue(query_hash, row, 'last_access_utc') |
141 date_time = dfdatetime_webkit_time.WebKitTime(timestamp=timestamp) | 145 date_time = dfdatetime_webkit_time.WebKitTime(timestamp=timestamp) |
142 event = time_events.DateTimeValuesEvent( | 146 event = time_events.DateTimeValuesEvent( |
143 date_time, definitions.TIME_DESCRIPTION_LAST_ACCESS) | 147 date_time, definitions.TIME_DESCRIPTION_LAST_ACCESS) |
144 parser_mediator.ProduceEventWithEventData(event, event_data) | 148 parser_mediator.ProduceEventWithEventData(event, event_data) |
145 | 149 |
146 if row['has_expires']: | 150 timestamp = self._GetRowValue(query_hash, row, 'has_expires') |
147 timestamp = row['expires_utc'] | 151 if timestamp: |
148 date_time = dfdatetime_webkit_time.WebKitTime(timestamp=timestamp) | 152 date_time = dfdatetime_webkit_time.WebKitTime(timestamp=timestamp) |
149 event = time_events.DateTimeValuesEvent( | 153 event = time_events.DateTimeValuesEvent( |
150 date_time, 'Cookie Expires') | 154 date_time, 'Cookie Expires') |
151 parser_mediator.ProduceEventWithEventData(event, event_data) | 155 parser_mediator.ProduceEventWithEventData(event, event_data) |
152 | 156 |
153 for plugin in self._cookie_plugins: | 157 for plugin in self._cookie_plugins: |
154 if cookie_name != plugin.COOKIE_NAME: | 158 if cookie_name != plugin.COOKIE_NAME: |
155 continue | 159 continue |
156 | 160 |
157 try: | 161 try: |
158 plugin.UpdateChainAndProcess( | 162 plugin.UpdateChainAndProcess( |
159 parser_mediator, cookie_data=cookie_data, cookie_name=cookie_name, | 163 parser_mediator, cookie_data=cookie_data, cookie_name=cookie_name, |
160 url=url) | 164 url=url) |
161 | 165 |
162 except Exception as exception: # pylint: disable=broad-except | 166 except Exception as exception: # pylint: disable=broad-except |
163 parser_mediator.ProduceExtractionError( | 167 parser_mediator.ProduceExtractionError( |
164 'plugin: {0:s} unable to parse cookie with error: {1!s}'.format( | 168 'plugin: {0:s} unable to parse cookie with error: {1!s}'.format( |
165 plugin.NAME, exception)) | 169 plugin.NAME, exception)) |
166 | 170 |
167 | 171 |
168 sqlite.SQLiteParser.RegisterPlugin(ChromeCookiePlugin) | 172 sqlite.SQLiteParser.RegisterPlugin(ChromeCookiePlugin) |
LEFT | RIGHT |