Source code for plaso.parsers.cookie_plugins.interface

# -*- coding: utf-8 -*-
"""This file contains an interface for browser cookie plugins."""

import abc

from dfdatetime import posix_time as dfdatetime_posix_time

from plaso.lib import errors
from plaso.parsers import plugins


[docs] class BaseCookiePlugin(plugins.BasePlugin): """A browser cookie plugin for Plaso. This is a generic cookie parsing interface that can handle parsing cookies from all browsers. """ NAME = 'cookie_plugin' DATA_FORMAT = 'Browser cookie data' # The name of the cookie value that this plugin is designed to parse. # This value is used to evaluate whether the plugin is the correct one # to parse the browser cookie. COOKIE_NAME = '' @abc.abstractmethod def _ParseCookieData( self, parser_mediator, cookie_data=None, url=None, **kwargs): """Extracts events from cookie data. Args: parser_mediator (ParserMediator): mediates interactions between parsers and other components, such as storage and dfVFS. cookie_data (Optional[bytes]): cookie data, as a byte sequence. url (Optional[str]): URL or path where the cookie was set. """ def _ParseIntegerValue(self, string_value): """Parses an integer time. Args: string_value (str): string value. Returns: int: integer value or None if not available. """ try: return int(string_value, 10) except (TypeError, ValueError): return None def _ParsePosixTime(self, string_value): """Parses a POSIX time. Args: string_value (str): string value. Returns: dfdatetime.PosixTime: date and time value or None if not available. """ try: timestamp = int(string_value, 10) except (TypeError, ValueError): return None return dfdatetime_posix_time.PosixTime(timestamp=timestamp) def _ParsePosixTimeInMilliseconds(self, string_value): """Parses a POSIX time in milliseconds. Args: string_value (str): string value. Returns: dfdatetime.PosixTimeInMilliseconds: date and time value or None if not available. """ try: timestamp = int(string_value, 10) except (TypeError, ValueError): return None return dfdatetime_posix_time.PosixTimeInMilliseconds(timestamp=timestamp) def _ParsePosixTimeIn100Nanoseconds(self, string_value): """Parses a POSIX time in 100 nanoseconds intervals. Args: string_value (str): string value. Returns: dfdatetime.PosixTimeInMicroseconds: date and time value or None if not available. """ try: timestamp = int(string_value, 10) # TODO: fix that we're losing precision here. timestamp //= 10 except (TypeError, ValueError): return None return dfdatetime_posix_time.PosixTimeInMicroseconds(timestamp=timestamp) # pylint: disable=arguments-differ
[docs] def Process(self, parser_mediator, cookie_name, cookie_data, url, **kwargs): """Extracts events from cookie data. Args: parser_mediator (ParserMediator): mediates interactions between parsers and other components, such as storage and dfVFS. cookie_name (str): the name of the cookie value. cookie_data (bytes): the cookie data, as a byte sequence. url (str): the full URL or path where the cookie was set. Raises: errors.WrongPlugin: If the cookie name differs from the one supplied in COOKIE_NAME. ValueError: If cookie_name or cookie_data are not set. """ if cookie_name is None or cookie_data is None: raise ValueError('Cookie name or data are not set.') if cookie_name != self.COOKIE_NAME: raise errors.WrongPlugin( 'Not the correct cookie plugin for: {0:s} [{1:s}]'.format( cookie_name, self.NAME)) # This will raise if unhandled keyword arguments are passed. super(BaseCookiePlugin, self).Process(parser_mediator) self._ParseCookieData(parser_mediator, cookie_data=cookie_data, url=url)