chrome-tools 1.0.1 → 1.0.3

package/README.md

@@ -116,6 +116,9 @@ npx chrome-tools cookies
 # Filter cookies for a specific domain name
 npx chrome-tools cookies --domain "google.com" --limit 30
 
+# Filter cookies for a specific URL (matches domain, path, and secure status)
+npx chrome-tools cookies --url "https://github.com/settings/profile"
+
 # Skip decryption of encrypted values (fast metadata lookup)
 npx chrome-tools cookies --no-decrypt
 ```
@@ -224,7 +227,7 @@ All core functions accept an options object with the following fields:
 | `getBookmarks({chromeDir, profile, folder, search})` | `chrome-tools/bookmarks` | `Array<Bookmark>` |
 | `getHistory({chromeDir, profile, search, limit})` | `chrome-tools/history` | `Array<HistoryEntry>` |
 | `getSearchTerms({chromeDir, profile, limit})` | `chrome-tools/history` | `Array<SearchTerm>` |
-| `getCookies({chromeDir, profile, domain, decrypt, limit})` | `chrome-tools/cookies` | `Array<Cookie>` |
+| `getCookies({chromeDir, profile, domain, url, decrypt, limit})` | `chrome-tools/cookies` | `Array<Cookie>` |
 | `getAutofillEntries({chromeDir, profile, search, limit})` | `chrome-tools/autofill` | `Array<AutofillEntry>` |
 | `getCreditCards({chromeDir, profile})` | `chrome-tools/autofill` | `Array<CreditCard>` |
 | `getAddresses({chromeDir, profile})` | `chrome-tools/autofill` | `Array<Address>` |

package/bin/cli.js

@@ -325,6 +325,7 @@ addCommonOptions(addLimitOption(searchTermsCmd)).action((opts, cmd) => {
 const cookiesCmd = program.command("cookies").description("List cookies (encrypted values decrypted)");
 addCommonOptions(addLimitOption(cookiesCmd))
   .option("--domain <domain>", "Filter by domain")
+  .option("--url <url>", "Filter by URL with path")
   .option("--no-decrypt", "Skip decryption of encrypted values")
   .action((opts, cmd) => {
     const mergedOpts = cmd.optsWithGlobals();
@@ -332,6 +333,7 @@ addCommonOptions(addLimitOption(cookiesCmd))
       chromeDir: mergedOpts.chromeDir,
       profile: mergedOpts.profile,
       domain: mergedOpts.domain,
+      url: mergedOpts.url,
       decrypt: mergedOpts.decrypt !== false,
       limit: parseInt(mergedOpts.limit, 10) || 100,
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "chrome-tools",
-  "version": "1.0.1",
+  "version": "1.0.3",
   "description": "CLI & Node.js library to extract Chrome browser data (bookmarks, history, cookies, autofill, extensions, and more) on macOS",
   "type": "module",
   "main": "./src/index.js",
@@ -27,7 +27,7 @@
   ],
   "scripts": {
     "start": "node bin/cli.js",
-    "test": "node bin/cli.js --help",
+    "test": "node --test && node bin/cli.js --help",
     "release": "npm version patch --no-git-tag-version && npm publish"
   },
   "keywords": [
@@ -47,7 +47,7 @@
     "better-sqlite3": "^12.10.0",
     "chalk": "^5.6.2",
     "cli-table3": "^0.6.5",
-    "commander": "^13.0.0"
+    "commander": "^14.0.3"
   },
   "engines": {
     "node": ">=18.0.0"

package/src/core/crypto.js

@@ -12,8 +12,20 @@ const AES_IV = Buffer.alloc(16, " "); // 16 spaces (0x20)
  * @returns {string} The decrypted plaintext, or an error placeholder.
  */
 export function decryptValue(encryptedBlob, derivedKey) {
+  const decrypted = decryptValueBuffer(encryptedBlob, derivedKey);
+  return Buffer.isBuffer(decrypted) ? decrypted.toString("utf-8") : decrypted;
+}
+
+/**
+ * Decrypts a Chrome encrypted blob and returns the raw plaintext bytes.
+ *
+ * @param {Buffer|Uint8Array} encryptedBlob - The encrypted blob from the database.
+ * @param {Buffer} derivedKey - The derived 16-byte key.
+ * @returns {Buffer|string} The decrypted plaintext bytes, or an error placeholder.
+ */
+export function decryptValueBuffer(encryptedBlob, derivedKey) {
   if (!encryptedBlob || encryptedBlob.length === 0) {
-    return "";
+    return Buffer.alloc(0);
   }
 
   const blob = Buffer.isBuffer(encryptedBlob)
@@ -31,7 +43,7 @@ export function decryptValue(encryptedBlob, derivedKey) {
     const decipher = createDecipheriv("aes-128-cbc", derivedKey, AES_IV);
     let decrypted = decipher.update(ciphertext);
     decrypted = Buffer.concat([decrypted, decipher.final()]);
-    return decrypted.toString("utf-8");
+    return decrypted;
   } catch {
     return "<decryption failed>";
   }

package/src/modules/cookies.js

@@ -1,9 +1,85 @@
 import { join } from "node:path";
+import { createHash } from "node:crypto";
 import { resolveTargetProfiles } from "../core/chrome.js";
 import { deriveEncryptionKey } from "../core/keychain.js";
-import { decryptValue, chromeTimeToDate } from "../core/crypto.js";
+import { decryptValueBuffer, chromeTimeToDate } from "../core/crypto.js";
 import { queryDatabase, tableExists } from "../core/db.js";
 
+function decodeCookieValue(encryptedValue, derivedKey, hostKey) {
+  const decrypted = decryptValueBuffer(encryptedValue, derivedKey);
+  if (!Buffer.isBuffer(decrypted)) {
+    return decrypted;
+  }
+
+  const hostHash = createHash("sha256").update(hostKey).digest();
+  const valueBytes = decrypted.length >= hostHash.length && decrypted.subarray(0, hostHash.length).equals(hostHash)
+    ? decrypted.subarray(hostHash.length)
+    : decrypted;
+
+  return valueBytes.toString("utf-8");
+}
+
+function parseURL(urlStr) {
+  if (!urlStr) return null;
+  try {
+    return new URL(urlStr);
+  } catch (e) {
+    try {
+      // If it doesn't have a protocol, prepend https://
+      if (!/^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(urlStr)) {
+        return new URL("https://" + urlStr);
+      }
+    } catch (err) {
+      // Ignore
+    }
+  }
+  return null;
+}
+
+function getPossibleHostKeys(hostname) {
+  const keys = new Set();
+  keys.add(hostname);
+  keys.add("." + hostname);
+
+  const parts = hostname.split(".");
+  for (let i = 1; i < parts.length; i++) {
+    const suffix = parts.slice(i).join(".");
+    keys.add(suffix);
+    keys.add("." + suffix);
+  }
+  return Array.from(keys);
+}
+
+function domainMatch(hostname, hostKey) {
+  if (hostname === hostKey) {
+    return true;
+  }
+  if (hostKey.startsWith(".")) {
+    if (hostname === hostKey.slice(1) || hostname.endsWith(hostKey)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function pathMatch(urlPath, cookiePath) {
+  const uPath = urlPath || "/";
+  const cPath = cookiePath || "/";
+
+  if (cPath === "/") {
+    return true;
+  }
+  if (uPath === cPath) {
+    return true;
+  }
+  if (uPath.startsWith(cPath)) {
+    if (cPath.endsWith("/") || uPath[cPath.length] === "/") {
+      return true;
+    }
+  }
+  return false;
+}
+
 /**
  * Extracts cookies from Chrome's Cookies database.
  * Encrypted values are decrypted using the same mechanism as passwords.
@@ -12,14 +88,16 @@ import { queryDatabase, tableExists } from "../core/db.js";
  * @param {string} [options.chromeDir] - Chrome User Data directory.
  * @param {string} [options.profile] - Specific profile to target.
  * @param {string} [options.domain] - Filter by domain (case-insensitive, partial match).
+ * @param {string} [options.url] - Filter by URL (domain, path, and secure matching).
  * @param {boolean} [options.decrypt=true] - Whether to decrypt encrypted values.
  * @param {number} [options.limit=100] - Maximum number of results.
  * @returns {Array<Object>}
  */
-export function getCookies({ chromeDir, profile, domain, decrypt = true, limit = 100 } = {}) {
+export function getCookies({ chromeDir, profile, domain, url, decrypt = true, limit = 100 } = {}) {
   const profiles = resolveTargetProfiles({ chromeDir, profile });
   const derivedKey = decrypt ? deriveEncryptionKey() : null;
   const results = [];
+  const parsedUrl = parseURL(url);
 
   for (const p of profiles) {
     const dbPath = join(p.path, "Cookies");
@@ -36,22 +114,33 @@ export function getCookies({ chromeDir, profile, domain, decrypt = true, limit =
       if (domain) {
         conditions.push(`host_key LIKE ?`);
         params.push(`%${domain}%`);
+      } else if (parsedUrl) {
+        const hostKeys = getPossibleHostKeys(parsedUrl.hostname);
+        const placeholders = hostKeys.map(() => "?").join(", ");
+        conditions.push(`host_key IN (${placeholders})`);
+        params.push(...hostKeys);
       }
 
       if (conditions.length > 0) {
         sql += ` WHERE ${conditions.join(" AND ")}`;
       }
       sql += ` ORDER BY host_key, name`;
-      if (limit) {
+      if (limit && !url) {
         sql += ` LIMIT ${parseInt(limit, 10)}`;
       }
 
       const rows = queryDatabase(dbPath, sql, params);
 
       for (const row of rows) {
+        if (parsedUrl) {
+          if (!domainMatch(parsedUrl.hostname, row.host_key || "")) continue;
+          if (!pathMatch(parsedUrl.pathname || "/", row.path || "/")) continue;
+          if (row.is_secure && parsedUrl.protocol !== "https:") continue;
+        }
+
         let cookieValue = row.value || "";
         if (!cookieValue && row.encrypted_value && derivedKey) {
-          cookieValue = decryptValue(row.encrypted_value, derivedKey);
+          cookieValue = decodeCookieValue(row.encrypted_value, derivedKey, row.host_key);
         }
 
         results.push({
@@ -73,5 +162,17 @@ export function getCookies({ chromeDir, profile, domain, decrypt = true, limit =
     }
   }
 
+  if (limit && url) {
+    return results.slice(0, parseInt(limit, 10));
+  }
   return results;
 }
+
+export const _test = {
+  parseURL,
+  getPossibleHostKeys,
+  domainMatch,
+  pathMatch,
+};
+
+