137 lines
4.0 KiB
Python
137 lines
4.0 KiB
Python
#!/usr/bin/python
|
|
# -*- coding: utf-8 -*-
|
|
#
|
|
# Copyright 2013 The Plaso Project Authors.
|
|
# Please see the AUTHORS file for details on individual authors.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
"""This file contains a formatter for the Mozilla Firefox history."""
|
|
|
|
from plaso.lib import errors
|
|
from plaso.formatters import interface
|
|
|
|
|
|
class FirefoxBookmarkAnnotationFormatter(interface.ConditionalEventFormatter):
|
|
"""Formatter for a Firefox places.sqlite bookmark annotation."""
|
|
|
|
DATA_TYPE = 'firefox:places:bookmark_annotation'
|
|
|
|
FORMAT_STRING_PIECES = [
|
|
u'Bookmark Annotation: [{content}]',
|
|
u'to bookmark [{title}]',
|
|
u'({url})']
|
|
|
|
FORMAT_STRING_SHORT_PIECES = [u'Bookmark Annotation: {title}']
|
|
|
|
SOURCE_LONG = 'Firefox History'
|
|
SOURCE_SHORT = 'WEBHIST'
|
|
|
|
|
|
class FirefoxBookmarkFolderFormatter(interface.EventFormatter):
|
|
"""Formatter for a Firefox places.sqlite bookmark folder."""
|
|
|
|
DATA_TYPE = 'firefox:places:bookmark_folder'
|
|
|
|
FORMAT_STRING = u'{title}'
|
|
|
|
SOURCE_LONG = 'Firefox History'
|
|
SOURCE_SHORT = 'WEBHIST'
|
|
|
|
|
|
class FirefoxBookmarkFormatter(interface.ConditionalEventFormatter):
|
|
"""Formatter for a Firefox places.sqlite URL bookmark."""
|
|
|
|
DATA_TYPE = 'firefox:places:bookmark'
|
|
|
|
FORMAT_STRING_PIECES = [
|
|
u'Bookmark {type}',
|
|
u'{title}',
|
|
u'({url})',
|
|
u'[{places_title}]',
|
|
u'visit count {visit_count}']
|
|
|
|
FORMAT_STRING_SHORT_PIECES = [
|
|
u'Bookmarked {title}',
|
|
u'({url})']
|
|
|
|
SOURCE_LONG = 'Firefox History'
|
|
SOURCE_SHORT = 'WEBHIST'
|
|
|
|
|
|
class FirefoxPageVisitFormatter(interface.ConditionalEventFormatter):
|
|
"""Formatter for a Firefox places.sqlite page visited."""
|
|
|
|
DATA_TYPE = 'firefox:places:page_visited'
|
|
|
|
# Transitions defined in the source file:
|
|
# src/toolkit/components/places/nsINavHistoryService.idl
|
|
# Also contains further explanation into what each of these settings mean.
|
|
_URL_TRANSITIONS = {
|
|
1: 'LINK',
|
|
2: 'TYPED',
|
|
3: 'BOOKMARK',
|
|
4: 'EMBED',
|
|
5: 'REDIRECT_PERMANENT',
|
|
6: 'REDIRECT_TEMPORARY',
|
|
7: 'DOWNLOAD',
|
|
8: 'FRAMED_LINK',
|
|
}
|
|
_URL_TRANSITIONS.setdefault('UNKOWN')
|
|
|
|
# TODO: Make extra conditional formatting.
|
|
FORMAT_STRING_PIECES = [
|
|
u'{url}',
|
|
u'({title})',
|
|
u'[count: {visit_count}]',
|
|
u'Host: {host}',
|
|
u'{extra_string}']
|
|
|
|
FORMAT_STRING_SHORT_PIECES = [u'URL: {url}']
|
|
|
|
SOURCE_LONG = 'Firefox History'
|
|
SOURCE_SHORT = 'WEBHIST'
|
|
|
|
def GetMessages(self, event_object):
|
|
"""Return the message strings."""
|
|
if self.DATA_TYPE != event_object.data_type:
|
|
raise errors.WrongFormatter(u'Unsupported data type: {0:s}.'.format(
|
|
event_object.data_type))
|
|
|
|
transition = self._URL_TRANSITIONS.get(
|
|
getattr(event_object, 'visit_type', 0), None)
|
|
|
|
if transition:
|
|
transition_str = u'Transition: {0!s}'.format(transition)
|
|
|
|
if hasattr(event_object, 'extra'):
|
|
if transition:
|
|
event_object.extra.append(transition_str)
|
|
event_object.extra_string = u' '.join(event_object.extra)
|
|
elif transition:
|
|
event_object.extra_string = transition_str
|
|
|
|
return super(FirefoxPageVisitFormatter, self).GetMessages(event_object)
|
|
|
|
|
|
class FirefoxDowloadFormatter(interface.EventFormatter):
|
|
"""Formatter for a Firefox downloads.sqlite download."""
|
|
|
|
DATA_TYPE = 'firefox:downloads:download'
|
|
|
|
FORMAT_STRING = (u'{url} ({full_path}). Received: {received_bytes} bytes '
|
|
u'out of: {total_bytes} bytes.')
|
|
FORMAT_STRING_SHORT = u'{full_path} downloaded ({received_bytes} bytes)'
|
|
|
|
SOURCE_LONG = 'Firefox History'
|
|
SOURCE_SHORT = 'WEBHIST'
|