示例#1
0
    def testParsingFirefox29CookieDatabase(self):
        """Tests the Process function on a Firefox 29 cookie database file."""
        plugin = firefox_cookies.FirefoxCookiePlugin()
        test_file = self._GetTestFilePath([u'firefox_cookies.sqlite'])
        event_queue_consumer = self._ParseDatabaseFileWithPlugin(
            plugin, test_file)
        event_objects = self._GetAnalyticsCookies(event_queue_consumer)

        self.assertEqual(len(event_objects), 25)

        event_object = event_objects[14]

        self.assertEqual(
            event_object.utmcct,
            u'/frettir/erlent/2013/10/30/maelt_med_kerfisbundnum_hydingum/')
        expected_timestamp = timelib.Timestamp.CopyFromString(
            u'2013-10-30 21:56:06')
        self.assertEqual(event_object.timestamp, expected_timestamp)
        self.assertEqual(event_object.url, u'http://ads.aha.is/')
        self.assertEqual(event_object.utmcsr, u'mbl.is')

        expected_msg = (
            u'http://ads.aha.is/ (__utmz) Sessions: 1 Domain Hash: 137167072 '
            u'Sources: 1 Last source used to access: mbl.is Ad campaign '
            u'information: (referral) Last type of visit: referral Path to '
            u'the page of referring link: /frettir/erlent/2013/10/30/'
            u'maelt_med_kerfisbundnum_hydingum/')

        self._TestGetMessageStrings(event_object, expected_msg,
                                    u'http://ads.aha.is/ (__utmz)')
示例#2
0
    def testParsingFirefox29CookieDatabase(self):
        """Tests the Process function on a Firefox 29 cookie database file."""
        plugin = firefox_cookies.FirefoxCookiePlugin()
        storage_writer = self._ParseDatabaseFileWithPlugin(
            ['firefox_cookies.sqlite'], plugin)
        events = self._GetAnalyticsCookieEvents(storage_writer)

        self.assertEqual(storage_writer.number_of_warnings, 0)
        self.assertEqual(len(events), 25)

        event = events[14]

        self.CheckTimestamp(event.timestamp, '2013-10-30 21:56:06.000000')

        event_data = self._GetEventDataOfEvent(storage_writer, event)

        self.assertEqual(
            event_data.utmcct,
            '/frettir/erlent/2013/10/30/maelt_med_kerfisbundnum_hydingum/')
        self.assertEqual(event_data.url, 'http://ads.aha.is/')
        self.assertEqual(event_data.utmcsr, 'mbl.is')

        expected_message = (
            'http://ads.aha.is/ (__utmz) Sessions: 1 Domain Hash: 137167072 '
            'Sources: 1 Last source used to access: mbl.is Ad campaign '
            'information: (referral) Last type of visit: referral Path to '
            'the page of referring link: /frettir/erlent/2013/10/30/'
            'maelt_med_kerfisbundnum_hydingum/')
        expected_short_message = 'http://ads.aha.is/ (__utmz)'

        self._TestGetMessageStrings(event, expected_message,
                                    expected_short_message)
示例#3
0
  def testProcess(self):
    """Tests the Process function on a Firefox 29 cookie database file."""
    plugin = firefox_cookies.FirefoxCookiePlugin()
    storage_writer = self._ParseDatabaseFileWithPlugin(
        ['firefox_cookies.sqlite'], plugin)

    # sqlite> SELECT COUNT(id) FROM moz_cookies;
    # 90
    # Thus the cookie database contains 93 entries:
    #   90 Last Access Time
    #   90 Cookie Expires
    #   90 Creation Time
    #
    # And then in addition the following entries are added due to cookie
    # plugins (TODO filter these out since adding new cookie plugin will
    # change this number and thus affect this test):
    #  15 Last Visited Time
    #   5 Analytics Previous Time
    #   5 Analytics Creation Time
    #
    # In total: 93 * 3 + 15 + 5 + 5 = 304 events.

    events = []
    extra_objects = []
    for event in storage_writer.GetEvents():
      event_data = self._GetEventDataOfEvent(storage_writer, event)
      if event_data.data_type == 'firefox:cookie:entry':
        events.append(event)
      else:
        extra_objects.append(event)

    self.assertEqual(len(events), 90 * 3)
    self.assertGreaterEqual(len(extra_objects), 25)

    # Check one greenqloud.com event
    expected_event_values = {
        'cookie_name': '__utma',
        'data_type': 'firefox:cookie:entry',
        'host': 's.greenqloud.com',
        'httponly': False,
        'secure': False,
        'timestamp': '2015-10-30 21:56:03.000000',
        'timestamp_desc': definitions.TIME_DESCRIPTION_EXPIRATION,
        'url': 'http://s.greenqloud.com/'}

    self.CheckEventValues(storage_writer, events[32], expected_event_values)

    # Check one of the visits to pubmatic.com.
    expected_event_values = {
        'cookie_name': 'KRTBCOOKIE_391',
        'data_type': 'firefox:cookie:entry',
        'httponly': False,
        'path': '/',
        'secure': False,
        'timestamp': '2013-11-29 21:56:04.000000',
        'timestamp_desc': definitions.TIME_DESCRIPTION_EXPIRATION,
        'url': 'http://pubmatic.com/'}

    self.CheckEventValues(storage_writer, events[62], expected_event_values)
示例#4
0
文件: ganalytics.py 项目: dfjxs/plaso
    def testParsingFirefox29CookieDatabase(self):
        """Tests the Process function on a Firefox 29 cookie database file."""
        plugin = firefox_cookies.FirefoxCookiePlugin()
        storage_writer = self._ParseDatabaseFileWithPlugin(
            ['firefox_cookies.sqlite'], plugin)
        events = self._GetAnalyticsCookieEvents(storage_writer)

        self.assertEqual(len(events), 25)
        self.assertEqual(storage_writer.number_of_extraction_warnings, 0)
        self.assertEqual(storage_writer.number_of_recovery_warnings, 0)

        expected_event_values = {
            'cookie_name':
            '__utmz',
            'data_type':
            'cookie:google:analytics:utmz',
            'date_time':
            '2013-10-30 21:56:06',
            'domain_hash':
            '137167072',
            'sessions':
            1,
            'sources':
            1,
            'url':
            'http://ads.aha.is/',
            'utmccn':
            '(referral)',
            'utmcct':
            ('/frettir/erlent/2013/10/30/maelt_med_kerfisbundnum_hydingum/'),
            'utmcmd':
            'referral',
            'utmcsr':
            'mbl.is'
        }

        self.CheckEventValues(storage_writer, events[14],
                              expected_event_values)
示例#5
0
 def setUp(self):
     """Sets up the needed objects used throughout the test."""
     self._plugin = firefox_cookies.FirefoxCookiePlugin()
示例#6
0
    def testProcess(self):
        """Tests the Process function on a Firefox 29 cookie database file."""
        plugin = firefox_cookies.FirefoxCookiePlugin()
        storage_writer = self._ParseDatabaseFileWithPlugin(
            ['firefox_cookies.sqlite'], plugin)

        test_events = []
        extra_objects = []

        # sqlite> SELECT COUNT(id) FROM moz_cookies;
        # 90
        # Thus the cookie database contains 93 entries:
        #   90 Last Access Time
        #   90 Cookie Expires
        #   90 Creation Time
        #
        # And then in addition the following entries are added due to cookie
        # plugins (TODO filter these out since adding new cookie plugin will
        # change this number and thus affect this test):
        #  15 Last Visited Time
        #   5 Analytics Previous Time
        #   5 Analytics Creation Time
        #
        # In total: 93 * 3 + 15 + 5 + 5 = 304 events.
        for event in storage_writer.GetEvents():
            event_data = self._GetEventDataOfEvent(storage_writer, event)
            if event_data.data_type == 'firefox:cookie:entry':
                test_events.append(event)
            else:
                extra_objects.append(event)

        self.assertEqual(len(test_events), 90 * 3)
        self.assertGreaterEqual(len(extra_objects), 25)

        # Check one greenqloud.com event
        event = test_events[32]

        self.CheckTimestamp(event.timestamp, '2015-10-30 21:56:03.000000')
        self.assertEqual(event.timestamp_desc,
                         definitions.TIME_DESCRIPTION_EXPIRATION)

        event_data = self._GetEventDataOfEvent(storage_writer, event)
        self.assertEqual(event_data.host, 's.greenqloud.com')
        self.assertEqual(event_data.cookie_name, '__utma')
        self.assertFalse(event_data.httponly)
        self.assertEqual(event_data.url, 'http://s.greenqloud.com/')

        expected_message = (
            'http://s.greenqloud.com/ (__utma) Flags: [HTTP only]: False')
        expected_short_message = 's.greenqloud.com (__utma)'
        self._TestGetMessageStrings(event_data, expected_message,
                                    expected_short_message)

        # Check one of the visits to pubmatic.com.
        event = test_events[62]

        self.CheckTimestamp(event.timestamp, '2013-11-29 21:56:04.000000')
        self.assertEqual(event.timestamp_desc,
                         definitions.TIME_DESCRIPTION_EXPIRATION)

        event_data = self._GetEventDataOfEvent(storage_writer, event)
        self.assertEqual(event_data.url, 'http://pubmatic.com/')
        self.assertEqual(event_data.path, '/')
        self.assertFalse(event_data.secure)

        expected_message = (
            'http://pubmatic.com/ (KRTBCOOKIE_391) Flags: [HTTP only]: False')
        expected_short_message = 'pubmatic.com (KRTBCOOKIE_391)'
        self._TestGetMessageStrings(event_data, expected_message,
                                    expected_short_message)
示例#7
0
 def setUp(self):
   """Makes preparations before running an individual test."""
   self._plugin = firefox_cookies.FirefoxCookiePlugin()