Exemple #1
0
    def Process(self, parser_mediator, plist_name, top_level, **kwargs):
        """Determine if this is the correct plugin; if so proceed with processing.

    Process() checks if the current plist being processed is a match for a
    plugin by comparing the PATH and KEY requirements defined by a plugin.  If
    both match processing continues; else raise WrongPlistPlugin.

    This function also extracts the required keys as defined in self.PLIST_KEYS
    from the plist and stores the result in self.match[key] and calls
    self.GetEntries() which holds the processing logic implemented by the
    plugin.

    Args:
      parser_mediator (ParserMediator): mediates interactions between parsers
          and other components, such as storage and dfvfs.
      plist_name (str): name of the plist.
      top_level (dict[str, object]): plist top-level key.

    Raises:
      ValueError: If top_level or plist_name are not set.
      WrongPlistPlugin: If this plugin is not able to process the given file.
    """
        if plist_name is None or top_level is None:
            raise ValueError('Top level or plist name are not set.')

        if plist_name.lower() != self.PLIST_PATH.lower():
            raise errors.WrongPlistPlugin(self.NAME, plist_name)

        if isinstance(top_level, dict):
            if not set(top_level.keys()).issuperset(self.PLIST_KEYS):
                raise errors.WrongPlistPlugin(self.NAME, plist_name)

        else:
            # Make sure we are getting back an object that has an iterator.
            if not hasattr(top_level, '__iter__'):
                raise errors.WrongPlistPlugin(self.NAME, plist_name)

            # This is a list and we need to just look at the first level
            # of keys there.
            keys = []
            for top_level_entry in top_level:
                if isinstance(top_level_entry, dict):
                    keys.extend(top_level_entry.keys())

            # Compare this is a set, which removes possible duplicate entries
            # in the list.
            if not set(keys).issuperset(self.PLIST_KEYS):
                raise errors.WrongPlistPlugin(self.NAME, plist_name)

        # This will raise if unhandled keyword arguments are passed.
        super(PlistPlugin, self).Process(parser_mediator)

        logger.debug('Plist Plugin Used: {0:s} for: {1:s}'.format(
            self.NAME, plist_name))
        match = self._GetKeys(top_level, self.PLIST_KEYS)
        self.GetEntries(parser_mediator, top_level=top_level, match=match)
Exemple #2
0
    def Process(self, plist_name=None, top_level=None, **kwargs):
        """Determine if this is the correct plugin; if so proceed with processing.

    Process() checks if the current plist being processed is a match for a
    plugin by comparing the PATH and KEY requirements defined by a plugin.  If
    both match processing continues; else raise WrongPlistPlugin.

    This function also extracts the required keys as defined in self.PLIST_KEYS
    from the plist and stores the result in self.match[key] and calls
    self.GetEntries() which holds the processing logic implemented by the
    plugin.

    Args:
      plist_name: Name of the plist file.
      top_level: Plist in dictionary form.

    Raises:
      WrongPlistPlugin: If this plugin is not able to process the given file.
      ValueError: If top_level or plist_name are not set.

    Returns:
      A generator of events processed by the plugin.
    """
        if plist_name is None or top_level is None:
            raise ValueError(u'Top level or plist name are not set.')

        if plist_name.lower() != self.PLIST_PATH.lower():
            raise errors.WrongPlistPlugin(self.plugin_name, plist_name)

        if isinstance(top_level, dict):
            if not set(top_level.keys()).issuperset(self.PLIST_KEYS):
                raise errors.WrongPlistPlugin(self.plugin_name, plist_name)
        else:
            # Make sure we are getting back an object that has an iterator.
            if not hasattr(top_level, '__iter__'):
                raise errors.WrongPlistPlugin(self.plugin_name, plist_name)

            # This is a list and we need to just look at the first level
            # of keys there.
            keys = []
            for top_level_entry in top_level:
                if isinstance(top_level_entry, dict):
                    keys.extend(top_level_entry.keys())

            # Compare this is a set, which removes possible duplicate entries
            # in the list.
            if not set(keys).issuperset(self.PLIST_KEYS):
                raise errors.WrongPlistPlugin(self.plugin_name, plist_name)

        super(PlistPlugin, self).Process(**kwargs)

        logging.debug(u'Plist Plugin Used: {} for: {}'.format(
            self.plugin_name, plist_name))
        match = GetKeys(top_level, self.PLIST_KEYS)
        return self.GetEntries(top_level=top_level, match=match)
Exemple #3
0
  def Process(self, parser_mediator, plist_name, top_level, **kwargs):
    """Check if it is a valid Apple account plist file name.

    Args:
      parser_mediator: A parser mediator object (instance of ParserMediator).
      plist_name: name of the plist file.
      top_level: dictionary with the plist file parsed.
    """
    if not plist_name.startswith(self.PLIST_PATH):
      raise errors.WrongPlistPlugin(self.NAME, plist_name)
    super(AppleAccountPlugin, self).Process(
        parser_mediator, plist_name=self.PLIST_PATH, top_level=top_level)
Exemple #4
0
  def Process(self, parser_mediator, plist_name, top_level, **kwargs):
    """Check if it is a valid Apple account plist file name.

    Args:
      parser_mediator (ParserMediator): mediates interactions between parsers
          and other components, such as storage and dfvfs.
      plist_name (str): name of the plist.
      top_level (dict[str, object]): plist top-level key.
    """
    if not plist_name.startswith(self.PLIST_PATH):
      raise errors.WrongPlistPlugin(self.NAME, plist_name)
    super(AppleAccountPlugin, self).Process(
        parser_mediator, plist_name=self.PLIST_PATH, top_level=top_level)
Exemple #5
0
    def Process(self, plist_name=None, top_level=None, **kwargs):
        """Check if it is a valid Apple account plist file name.

    Args:
      plist_name: name of the plist file.
      top_level: dictionary with the plist file parsed.

    Returns:
      A generator, self.GetEntries(), if the correct plugin, otherwise None.
    """
        if not plist_name.startswith(self.PLIST_PATH):
            raise errors.WrongPlistPlugin(self.plugin_name, plist_name)
        return super(AppleAccountPlugin,
                     self).Process(plist_name=self.PLIST_PATH,
                                   top_level=top_level,
                                   **kwargs)