116 lines
4.0 KiB
Python
116 lines
4.0 KiB
Python
|
#!/usr/bin/python
|
||
|
|
# -*- coding: utf-8 -*-
|
||
|
|
#
|
||
|
|
# Copyright 2013 The Plaso Project Authors.
|
||
|
|
# Please see the AUTHORS file for details on individual authors.
|
||
|
|
#
|
||
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
||
|
|
# you may not use this file except in compliance with the License.
|
||
|
|
# You may obtain a copy of the License at
|
||
|
|
#
|
||
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
||
|
|
#
|
||
|
|
# Unless required by applicable law or agreed to in writing, software
|
||
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
||
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||
|
|
# See the License for the specific language governing permissions and
|
||
|
|
# limitations under the License.
|
||
|
|
"""This file contains an interface for browser cookie plugins."""
|
||
|
|
|
||
|
|
import abc
|
||
|
|
|
||
|
|
from plaso.lib import errors
|
||
|
|
from plaso.lib import registry
|
||
|
|
from plaso.parsers import plugins
|
||
|
|
|
||
|
|
|
||
|
|
# TODO: move this into the parsers and plugins manager.
|
||
|
|
def GetPlugins():
|
||
|
|
"""Returns a list of all cookie plugins."""
|
||
|
|
plugins_list = []
|
||
|
|
for plugin_cls in CookiePlugin.classes.itervalues():
|
||
|
|
parent_name = getattr(plugin_cls, 'parent_class_name', 'NOTHERE')
|
||
|
|
if parent_name != 'cookie':
|
||
|
|
continue
|
||
|
|
|
||
|
|
plugins_list.append(plugin_cls())
|
||
|
|
|
||
|
|
return plugins_list
|
||
|
|
|
||
|
|
|
||
|
|
class CookiePlugin(plugins.BasePlugin):
|
||
|
|
"""A browser cookie plugin for Plaso.
|
||
|
|
|
||
|
|
This is a generic cookie parsing interface that can handle parsing
|
||
|
|
cookies from all browsers.
|
||
|
|
"""
|
||
|
|
__metaclass__ = registry.MetaclassRegistry
|
||
|
|
__abstract = True
|
||
|
|
|
||
|
|
NAME = 'cookie'
|
||
|
|
|
||
|
|
# The name of the cookie value that this plugin is designed to parse.
|
||
|
|
# This value is used to evaluate whether the plugin is the correct one
|
||
|
|
# to parse the browser cookie.
|
||
|
|
COOKIE_NAME = u''
|
||
|
|
|
||
|
|
def __init__(self):
|
||
|
|
"""Initialize the browser cookie plugin."""
|
||
|
|
super(CookiePlugin, self).__init__()
|
||
|
|
self.cookie_data = ''
|
||
|
|
|
||
|
|
@abc.abstractmethod
|
||
|
|
def GetEntries(
|
||
|
|
self, parser_context, file_entry=None, parser_chain=None,
|
||
|
|
cookie_data=None, url=None, **kwargs):
|
||
|
|
"""Extract and return EventObjects from the data structure.
|
||
|
|
|
||
|
|
Args:
|
||
|
|
parser_context: A parser context object (instance of ParserContext).
|
||
|
|
file_entry: Optional file entry object (instance of dfvfs.FileEntry).
|
||
|
|
The default is None.
|
||
|
|
parser_chain: Optional string containing the parsing chain up to this
|
||
|
|
point. The default is None.
|
||
|
|
cookie_data: Optional cookie data, as a byte string.
|
||
|
|
url: Optional URL or path where the cookie got set.
|
||
|
|
"""
|
||
|
|
|
||
|
|
def Process(
|
||
|
|
self, parser_context, file_entry=None, parser_chain=None,
|
||
|
|
cookie_name=None, cookie_data=None, url=None, **kwargs):
|
||
|
|
"""Determine if this is the right plugin for this cookie.
|
||
|
|
|
||
|
|
Args:
|
||
|
|
parser_context: A parser context object (instance of ParserContext).
|
||
|
|
file_entry: Optional file entry object (instance of dfvfs.FileEntry).
|
||
|
|
The default is None.
|
||
|
|
parser_chain: Optional string containing the parsing chain up to this
|
||
|
|
point. The default is None.
|
||
|
|
cookie_name: The name of the cookie value.
|
||
|
|
cookie_data: The cookie data, as a byte string.
|
||
|
|
url: The full URL or path where the cookie got set.
|
||
|
|
|
||
|
|
Raises:
|
||
|
|
errors.WrongPlugin: If the cookie name differs from the one
|
||
|
|
supplied in COOKIE_NAME.
|
||
|
|
ValueError: If cookie_name or cookie_data are not set.
|
||
|
|
"""
|
||
|
|
if cookie_name is None or cookie_data is None:
|
||
|
|
raise ValueError(u'Cookie name or data are not set.')
|
||
|
|
|
||
|
|
if cookie_name != self.COOKIE_NAME:
|
||
|
|
raise errors.WrongPlugin(
|
||
|
|
u'Not the correct cookie plugin for: {0:s} [{1:s}]'.format(
|
||
|
|
cookie_name, self.NAME))
|
||
|
|
|
||
|
|
# This will raise if unhandled keyword arguments are passed.
|
||
|
|
super(CookiePlugin, self).Process(parser_context, **kwargs)
|
||
|
|
|
||
|
|
# Add ourselves to the parser chain, which will be used in all subsequent
|
||
|
|
# event creation in this parser.
|
||
|
|
parser_chain = self._BuildParserChain(parser_chain)
|
||
|
|
|
||
|
|
self.GetEntries(
|
||
|
|
parser_context, file_entry=file_entry, parser_chain=parser_chain,
|
||
|
|
cookie_data=cookie_data, url=url)
|