<commit_before>'''
   Copyright (c) 2020 <NAME>

   This file is part of mac_apt (macOS Artifact Parsing Tool).
   Usage or distribution of this software/code is subject to the
   terms of the MIT License.

   cookies.py
   ---------------
   Reads Cookie information from .binarycookies, .cookies files and HSTS.plist for each user.

'''

import logging
import plugins.helpers.common
import struct
from biplist import *
from plugins.helpers.macinfo import *
from plugins.helpers.writer import *

__Plugin_Name = "COOKIES"
__Plugin_Friendly_Name = "Cookies"
__Plugin_Version = "1.0"
__Plugin_Description = "Reads .binarycookies, .cookies files and HSTS.plist for each user"
__Plugin_Author = "<NAME>"
__Plugin_Author_Email = "<EMAIL>"

__Plugin_Modes = "MACOS,ARTIFACTONLY"
__Plugin_ArtifactOnly_Usage = 'Provide the HSTS.plist file located at /Users/<USER>/Library/Cookielication Support/com.apple.spotlight/appList.dat'

log = logging.getLogger('MAIN.' + __Plugin_Name) # Do not rename or remove this ! This is the logger object

#---- Do not change the variable names in above section ----#

class Cookie:
    def __init__(self, host, create_time, expiry_time, name, path, value, user, source_path):
        self.host = host
        self.create_time = create_time
        self.expiry_time = expiry_time
        self.name = name
        self.path = path
        self.value = value
        self.user = user
        self.source_path = source_path

def PrintAll(cookies, output_params, input_path=''):
    cookies_info = [   ('Host',DataType.TEXT),
                    ('Create Time',DataType.DATE),
                    ('Expiry Time',DataType.DATE),
                    ('Name',DataType.TEXT),
                    ('Path',DataType.TEXT),
                    ('Value',DataType.TEXT),
                    ('User',DataType.TEXT),
                    ('Source',DataType.TEXT)
                ]

    log.info (str(len(cookies)) + " cookie(s) found")

    cookies_list_final = []
    for item in cookies:
        single_cookie_item = [item.host, item.create_time, item.expiry_time, 
                            item.name, item.path, item.value,
                            item.user, item.source_path ]
        cookies_list_final.append(single_cookie_item)

    WriteList("cookies List", "cookies", cookies_list_final, cookies_info, output_params, input_path)

def read_cstring(buffer):
    pos = buffer.find(b'\0')
    ret = ''
    if pos == -1:
        ret = buffer
    else:
        ret = buffer[0:pos]
    try:
        ret = ret.decode('utf8', 'backslashreplace')
    except UnicodeDecodeError:
        ret = ''
    return ret

def parse_cookie_file(cookie_file, cookies, user_name, file_path):
    '''Parse .binarycookies or .cookies file'''
    data = cookie_file.read()
    if data[0:4] == b'cook':
        num_pages = struct.unpack('>I', data[4:8])[0]
        if num_pages == 0:
            return
        page_sizes = []
        pos = 8
        for x in range(num_pages):
            page_sizes.append(struct.unpack('>I', data[pos : pos + 4])[0])
            pos +=4
        
        page_start = pos
        for page_size in page_sizes:
            # read page
            pos = page_start
            pos += 4
            num_cookies = struct.unpack('<I', data[pos : pos + 4])[0]
            pos += 4<commit_msg>add comments<commit_after>'''
   Copyright (c) 2020 <NAME>

   This file is part of mac_apt (macOS Artifact Parsing Tool).
   Usage or distribution of this software/code is subject to the
   terms of the MIT License.

   cookies.py
   ---------------
   Reads Cookie information from .binarycookies, .cookies files and HSTS.plist for each user.

'''

import logging
import plugins.helpers.common
import struct
from biplist import *
from plugins.helpers.macinfo import *
from plugins.helpers.writer import *

__Plugin_Name = "COOKIES"
__Plugin_Friendly_Name = "Cookies"
__Plugin_Version = "1.0"
__Plugin_Description = "Reads .binarycookies, .cookies files and HSTS.plist for each user"
__Plugin_Author = "<NAME>"
__Plugin_Author_Email = "<EMAIL>"

__Plugin_Modes = "MACOS,ARTIFACTONLY"
__Plugin_ArtifactOnly_Usage = 'Provide the HSTS.plist file located at /Users/<USER>/Library/Cookielication Support/com.apple.spotlight/appList.dat'

log = logging.getLogger('MAIN.' + __Plugin_Name) # Do not rename or remove this ! This is the logger object

#---- Do not change the variable names in above section ----#

class Cookie:
    def __init__(self, host, create_time, expiry_time, name, path, value, user, source_path):
        self.host = host
        self.create_time = create_time
        self.expiry_time = expiry_time
        self.name = name
        self.path = path
        self.value = value
        self.user = user
        self.source_path = source_path

def PrintAll(cookies, output_params, input_path=''):
    cookies_info = [   ('Host',DataType.TEXT),
                    ('Create Time',DataType.DATE),
                    ('Expiry Time',DataType.DATE),
                    ('Name',DataType.TEXT),
                    ('Path',DataType.TEXT),
                    ('Value',DataType.TEXT),
                    ('User',DataType.TEXT),
                    ('Source',DataType.TEXT)
                ]

    log.info (str(len(cookies)) + " cookie(s) found")

    cookies_list_final = []
    for item in cookies:
        single_cookie_item = [item.host, item.create_time, item.expiry_time, 
                            item.name, item.path, item.value,
                            item.user, item.source_path ]
        cookies_list_final.append(single_cookie_item)

    WriteList("cookies List", "cookies", cookies_list_final, cookies_info, output_params, input_path)

def read_cstring(buffer):
    pos = buffer.find(b'\0')
    ret = ''
    if pos == -1:
        ret = buffer
    else:
        ret = buffer[0:pos]
    try:
        ret = ret.decode('utf8', 'backslashreplace')
    except UnicodeDecodeError:
        ret = ''
    return ret

# BinaryCookie parsing based on Satishb's code from 
# https://github.com/as0ler/BinaryCookieReader/blob/master/BinaryCookieReader.py

def parse_cookie_file(cookie_file, cookies, user_name, file_path):
    '''Parse .binarycookies or .cookies file'''
    data = cookie_file.read()
    if data[0:4] == b'cook':
        num_pages = struct.unpack('>I', data[4:8])[0]
        if num_pages == 0:
            return
        page_sizes = []
        pos = 8
        for x in range(num_pages):
            page_sizes.append(struct.unpack('>I', data[pos : pos + 4])[0])
            pos +=4
        
        page_start = pos
        for page_size in page_sizes:
            # read page
            pos = page_start
            pos += 4
            num_cookies = struct.unpack('<I', data[pos : pos + 4])[0]
            pos += 4
{'fraction_non_alphanumeric': 0.1148049645390071, 'fraction_numerical': 0.007239952718676123, 'mean_word_length': 2.359305210918114, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 15, 'https://': 1, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2596564', 'n_tokens_mistral': 2103, 'n_tokens_neox': 2039, 'n_words': 522}