"""Plist parser plugin for Safari Downloads.plist files."""
from plaso.containers import events
from plaso.parsers import plist
from plaso.parsers.plist_plugins import interface
[docs]
class SafariDownloadEventData(events.EventData):
"""Safari download event data.
Attributes:
end_time (dfdatetime.DateTimeValues): date and time the download was
finished.
full_path (str): full path where the file was downloaded to.
received_bytes (int): number of bytes received while downloading.
remove_on_completion (bool): remove the download when completed (done).
start_time (dfdatetime.DateTimeValues): date and time the download was
started.
total_bytes (int): total number of bytes to download.
url (str): URL of the downloaded file.
"""
DATA_TYPE = "safari:downloads:entry"
[docs]
def __init__(self):
"""Initializes event data."""
super().__init__(data_type=self.DATA_TYPE)
self.end_time = None
self.full_path = None
self.received_bytes = None
self.remove_on_completion = None
self.start_time = None
self.total_bytes = None
self.url = None
[docs]
class SafariDownloadsPlistPlugin(interface.PlistPlugin):
"""Plist parser plugin for Safari Downloads.plist files."""
NAME = "safari_downloads"
DATA_FORMAT = "Safari Downloads plist file"
PLIST_PATH_FILTERS = frozenset([interface.PlistPathFilter("Downloads.plist")])
PLIST_KEYS = frozenset(["DownloadHistory"])
# pylint: disable=arguments-differ
def _ParsePlist(self, parser_mediator, match=None, **unused_kwargs):
"""Extracts relevant entries.
Args:
parser_mediator (ParserMediator): mediates interactions between parsers
and other components, such as storage and dfVFS.
match (Optional[dict[str: object]]): keys extracted from PLIST_KEYS.
"""
for plist_key in match.get("DownloadHistory", []):
event_data = SafariDownloadEventData()
event_data.end_time = self._GetDateTimeValueFromPlistKey(
plist_key, "DownloadEntryDateFinishedKey"
)
event_data.full_path = plist_key.get("DownloadEntryPath")
event_data.received_bytes = plist_key.get(
"DownloadEntryProgressBytesSoFar", None
)
event_data.remove_on_completion = plist_key.get(
"DownloadEntryRemoveWhenDoneKey", None
)
event_data.start_time = self._GetDateTimeValueFromPlistKey(
plist_key, "DownloadEntryDateAddedKey"
)
event_data.total_bytes = plist_key.get(
"DownloadEntryProgressTotalToLoad", None
)
event_data.url = plist_key.get("DownloadEntryURL")
parser_mediator.ProduceEventData(event_data)
plist.PlistParser.RegisterPlugin(SafariDownloadsPlistPlugin)