コード例 #1
0
    def testParseFile(self):
        """Tests the Parse function on a Safari binary cookies file."""
        parser = safari_cookies.BinaryCookieParser()
        storage_writer = self._ParseFile(['Cookies.binarycookies'], parser)

        events = []
        for event in storage_writer.GetEvents():
            event_data = self._GetEventDataOfEvent(storage_writer, event)
            if event_data.data_type == 'safari:cookie:entry':
                events.append(event)

        # There should be:
        # * 207 events in total
        # * 182 events from the safari cookie parser
        # * 25 event from the cookie plugins

        self.assertEqual(storage_writer.number_of_warnings, 0)
        self.assertEqual(storage_writer.number_of_events, 207)
        self.assertEqual(len(events), 182)

        expected_event_values = {
            'cookie_name': 'GAPS',
            'data_type': 'safari:cookie:entry',
            'flags': 5,
            'url': 'accounts.google.com'
        }

        self.CheckEventValues(storage_writer, events[3], expected_event_values)

        expected_event_values = {
            'cookie_name': 'nonsession',
            'data_type': 'safari:cookie:entry',
            'flags': 0,
            'path': '/',
            'timestamp': '2013-07-08 20:54:50.000000',
            'timestamp_desc': definitions.TIME_DESCRIPTION_CREATION,
            'url': '.ebay.com'
        }

        self.CheckEventValues(storage_writer, events[48],
                              expected_event_values)

        expected_event_values = {
            'cookie_name':
            'fpc',
            'cookie_value':
            ('d=0dTg3Ou32s3MrAJ2iHjFph100Tw3E1HTfDOTly0GfJ2g4W.mXpy54F9fjBFfXMw'
             '4YyWAG2cT2FVSqOvGGi_Y1OPrngmNvpKPPyz5gIUP6x_EQeM7bR3jsrg_F1UXVOgu'
             '6JgkFwqO5uHrv4HiL05qb.85Bl.V__HZI5wpAGOGPz1XHhY5mOMH.g.pkVDLli36W'
             '2iuYwA-&v=2'),
            'data_type':
            'safari:cookie:entry',
            'path':
            '/',
            'url':
            '.www.yahoo.com'
        }

        self.CheckEventValues(storage_writer, events[52],
                              expected_event_values)
コード例 #2
0
    def testParseFile(self):
        """Tests the Parse function on a Safari binary cookies file."""
        parser = safari_cookies.BinaryCookieParser()
        storage_writer = self._ParseFile(['Cookies.binarycookies'], parser)

        cookie_events = []
        for event in storage_writer.GetEvents():
            event_data = self._GetEventDataOfEvent(storage_writer, event)
            if event_data.data_type == 'safari:cookie:entry':
                cookie_events.append(event)

        # There should be:
        # * 207 events in total
        # * 182 events from the safari cookie parser
        # * 25 event from the cookie plugins

        self.assertEqual(storage_writer.number_of_warnings, 0)
        self.assertEqual(storage_writer.number_of_events, 207)
        self.assertEqual(len(cookie_events), 182)

        event = cookie_events[3]
        event_data = self._GetEventDataOfEvent(storage_writer, event)
        self.assertEqual(event_data.flags, 5)
        self.assertEqual(event_data.url, 'accounts.google.com')
        self.assertEqual(event_data.cookie_name, 'GAPS')

        event = cookie_events[48]

        self.CheckTimestamp(event.timestamp, '2013-07-08 20:54:50.000000')
        self.assertEqual(event.timestamp_desc,
                         definitions.TIME_DESCRIPTION_CREATION)

        event_data = self._GetEventDataOfEvent(storage_writer, event)
        self.assertEqual(event_data.flags, 0)
        self.assertEqual(event_data.cookie_name, 'nonsession')
        self.assertEqual(event_data.path, '/')

        expected_message = '.ebay.com </> (nonsession)'
        expected_short_message = '.ebay.com (nonsession)'

        self._TestGetMessageStrings(event_data, expected_message,
                                    expected_short_message)

        event = cookie_events[52]
        event_data = self._GetEventDataOfEvent(storage_writer, event)
        self.assertEqual(event_data.cookie_name, 'fpc')
        value = (
            'd=0dTg3Ou32s3MrAJ2iHjFph100Tw3E1HTfDOTly0GfJ2g4W.mXpy54F9fjBFfXMw4YyW'
            'AG2cT2FVSqOvGGi_Y1OPrngmNvpKPPyz5gIUP6x_EQeM7bR3jsrg_F1UXVOgu6JgkFwqO'
            '5uHrv4HiL05qb.85Bl.V__HZI5wpAGOGPz1XHhY5mOMH.g.pkVDLli36W2iuYwA-&v=2'
        )
        self.assertEqual(event_data.cookie_value, value)

        self.assertEqual(event_data.path, '/')
        self.assertEqual(event_data.url, '.www.yahoo.com')
コード例 #3
0
ファイル: safari_cookies.py プロジェクト: bethlogic/plaso
    def testParseFile(self):
        """Tests the Parse function on a version 17 Prefetch file."""
        parser_object = safari_cookies.BinaryCookieParser()

        test_file = self._GetTestFilePath([u'Cookies.binarycookies'])
        event_queue_consumer = self._ParseFile(parser_object, test_file)
        event_objects = self._GetEventObjectsFromQueue(event_queue_consumer)

        # There should be 182 events from the safari cookie parser in addition
        # to those created by cookie plugins.
        self.assertTrue(len(event_objects) >= 182)

        cookie_events = []
        for event_object in event_objects:
            if isinstance(event_object, safari_cookies.BinaryCookieEvent):
                cookie_events.append(event_object)

        self.assertEqual(len(cookie_events), 182)

        event_object = cookie_events[3]
        self.assertEqual(event_object.flags, u'HttpOnly|Secure')
        self.assertEqual(event_object.url, u'accounts.google.com')
        self.assertEqual(event_object.cookie_name, u'GAPS')

        event_object = cookie_events[48]

        self.assertEqual(event_object.flags, u'')
        expected_timestamp = timelib.Timestamp.CopyFromString(
            u'2013-07-08 20:54:50')

        self.assertEqual(event_object.timestamp, expected_timestamp)
        self.assertEqual(event_object.timestamp_desc,
                         eventdata.EventTimestamp.CREATION_TIME)
        self.assertEqual(event_object.cookie_name, u'nonsession')
        self.assertEqual(event_object.path, u'/')

        expected_msg = u'.ebay.com </> (nonsession)'
        expected_msg_short = u'.ebay.com (nonsession)'

        self._TestGetMessageStrings(event_object, expected_msg,
                                    expected_msg_short)

        event_object = cookie_events[52]
        self.assertEqual(event_object.cookie_name, u'fpc')
        value = (
            u'd=0dTg3Ou32s3MrAJ2iHjFph100Tw3E1HTfDOTly0GfJ2g4W.mXpy54F9fjBFfXMw4YyW'
            u'AG2cT2FVSqOvGGi_Y1OPrngmNvpKPPyz5gIUP6x_EQeM7bR3jsrg_F1UXVOgu6JgkFwqO'
            u'5uHrv4HiL05qb.85Bl.V__HZI5wpAGOGPz1XHhY5mOMH.g.pkVDLli36W2iuYwA-&v=2'
        )
        self.assertEqual(event_object.cookie_value, value)

        self.assertEqual(event_object.path, u'/')
        self.assertEqual(event_object.url, u'.www.yahoo.com')
コード例 #4
0
ファイル: safari_cookies.py プロジェクト: vertigo0001/plaso
 def setUp(self):
     """Sets up the needed objects used throughout the test."""
     self._parser = safari_cookies.BinaryCookieParser()
コード例 #5
0
ファイル: safari_cookies.py プロジェクト: vonnopsled/plaso
 def setUp(self):
     """Makes preparations before running an individual test."""
     self._parser = safari_cookies.BinaryCookieParser()