dissect.target 3.16.dev20__tar.gz → 3.16.dev22__tar.gz

{dissect.target-3.16.dev20/dissect.target.egg-info → dissect.target-3.16.dev22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.16.dev20
+Version: 3.16.dev22
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.16.dev20 → dissect.target-3.16.dev22}/dissect/target/filesystems/config.py

@@ -120,9 +120,9 @@ class ConfigurationFilesystem(VirtualFilesystem):
         try:
             config_parser = parse(entry, *args, **kwargs)
             entry = ConfigurationEntry(self, entry.path, entry, config_parser)
-        except ConfigurationParsingError:
+        except ConfigurationParsingError as e:
             # If a parsing error gets created, it should return the `entry`
-            log.debug("Error when parsing %s", entry.path)
+            log.debug("Error when parsing %s with message '%s'", entry.path, e)
 
         return entry
 
@@ -220,13 +220,15 @@ class ConfigurationEntry(FilesystemEntry):
         output_buffer = io.StringIO()
 
         if isinstance(values, list):
-            output_buffer.write(textwrap.indent(text="\n".join(values), prefix=prefix))
+            # Explicitly convert the list values to strings
+            _text = "\n".join(str(val) for val in values)
+            output_buffer.write(textwrap.indent(text=_text, prefix=prefix))
         elif hasattr(values, "keys"):
             for key, value in values.items():
                 output_buffer.write(textwrap.indent(key, prefix=prefix) + "\n")
                 output_buffer.write(self._write_value_mapping(value, indentation_nr + 4))
         else:
-            output_buffer.write(textwrap.indent(values, prefix=prefix) + "\n")
+            output_buffer.write(textwrap.indent(str(values), prefix=prefix) + "\n")
 
         return output_buffer.getvalue()
 

{dissect.target-3.16.dev20 → dissect.target-3.16.dev22}/dissect/target/helpers/configutil.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import io
+import json
 import re
 from collections import deque
 from configparser import ConfigParser, MissingSectionHeaderError
@@ -26,6 +27,13 @@ from dissect.target.exceptions import ConfigurationParsingError, FileNotFoundErr
 from dissect.target.filesystem import FilesystemEntry
 from dissect.target.helpers.fsutil import TargetPath
 
+try:
+    import yaml
+
+    PY_YAML = True
+except (AttributeError, ImportError):
+    PY_YAML = False
+
 
 def _update_dictionary(current: dict[str, Any], key: str, value: Any) -> None:
     if prev_value := current.get(key):
@@ -151,7 +159,7 @@ class ConfigurationParser:
         try:
             self.parse_file(fh)
         except Exception as e:
-            raise ConfigurationParsingError from e
+            raise ConfigurationParsingError(*e.args) from e
 
         if self.collapse_all or self.collapse:
             self.parsed_data = self._collapse_dict(self.parsed_data)
@@ -329,6 +337,77 @@ class Xml(ConfigurationParser):
         self.parsed_data = tree
 
 
+class ListUnwrapper:
+    """Provides utility functions to unwrap dictionary objects out of lists."""
+
+    @staticmethod
+    def unwrap(data: Union[dict, list]) -> Union[dict, list]:
+        """Transforms a list with dictionaries to a dictionary.
+
+        The order of the list is preserved. If no dictionary is found,
+        the list remains untouched:
+
+            ["value1", "value2"]    -> ["value1", "value2"]
+
+            {"data": "value"}       -> {"data": "value"}
+
+            [{"data": "value"}]     -> {
+                                           "list_item0": {
+                                                "data": "value"
+                                           }
+                                       }
+        """
+        orig = ListUnwrapper._unwrap_dict_list(data)
+        return ListUnwrapper._unwrap_dict(orig)
+
+    @staticmethod
+    def _unwrap_dict(data: Union[dict, list]) -> Union[dict, list]:
+        """Looks for dictionaries and unwraps its values."""
+
+        if not isinstance(data, dict):
+            return data
+
+        root = dict()
+        for key, value in data.items():
+            _value = ListUnwrapper._unwrap_dict_list(value)
+            if isinstance(_value, dict):
+                _value = ListUnwrapper._unwrap_dict(_value)
+            root[key] = _value
+
+        return root
+
+    @staticmethod
+    def _unwrap_dict_list(data: Union[dict, list]) -> Union[dict, list]:
+        """Unwraps a list containing dictionaries."""
+        if not isinstance(data, list) or not any(isinstance(obj, dict) for obj in data):
+            return data
+
+        return_value = {}
+        for idx, elem in enumerate(data):
+            return_value[f"list_item{idx}"] = elem
+
+        return return_value
+
+
+class Json(ConfigurationParser):
+    """Parses a JSON file."""
+
+    def parse_file(self, fh: TextIO):
+        parsed_data = json.load(fh)
+        self.parsed_data = ListUnwrapper.unwrap(parsed_data)
+
+
+class Yaml(ConfigurationParser):
+    """Parses a Yaml file."""
+
+    def parse_file(self, fh: TextIO) -> None:
+        if PY_YAML:
+            parsed_data = yaml.load(fh, yaml.BaseLoader)
+            self.parsed_data = ListUnwrapper.unwrap(parsed_data)
+        else:
+            raise ConfigurationParsingError("Failed to parse file, please install PyYAML.")
+
+
 class ScopeManager:
     """A (context)manager for dictionary scoping.
 
@@ -609,7 +688,9 @@ MATCH_MAP: dict[str, ParserConfig] = {
 CONFIG_MAP: dict[tuple[str, ...], ParserConfig] = {
     "ini": ParserConfig(Ini),
     "xml": ParserConfig(Xml),
-    "json": ParserConfig(Txt),
+    "json": ParserConfig(Json),
+    "yml": ParserConfig(Yaml),
+    "yaml": ParserConfig(Yaml),
     "cnf": ParserConfig(Default),
     "conf": ParserConfig(Default, separator=(r"\s",)),
     "sample": ParserConfig(Txt),

dissect.target-3.16.dev22/dissect/target/plugins/apps/browser/brave.py

@@ -0,0 +1,68 @@
+from typing import Iterator
+
+from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
+from dissect.target.helpers.record import create_extended_descriptor
+from dissect.target.plugin import export
+from dissect.target.plugins.apps.browser.browser import (
+    GENERIC_COOKIE_FIELDS,
+    GENERIC_DOWNLOAD_RECORD_FIELDS,
+    GENERIC_EXTENSION_RECORD_FIELDS,
+    GENERIC_HISTORY_RECORD_FIELDS,
+    BrowserPlugin,
+)
+from dissect.target.plugins.apps.browser.chromium import (
+    CHROMIUM_DOWNLOAD_RECORD_FIELDS,
+    ChromiumMixin,
+)
+
+
+class BravePlugin(ChromiumMixin, BrowserPlugin):
+    """Brave browser plugin."""
+
+    __namespace__ = "brave"
+
+    DIRS = [
+        # Windows
+        "AppData/Local/BraveSoftware/Brave-Browser/User Data/Default",
+        "AppData/Roaming/BraveSoftware/Brave-Browser/User Data/Default",
+        # Linux
+        ".config/BraveSoftware/Default",
+        # Macos
+        "Library/Application Support/BraveSoftware/Default",
+    ]
+
+    BrowserHistoryRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
+        "browser/brave/history", GENERIC_HISTORY_RECORD_FIELDS
+    )
+
+    BrowserCookieRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
+        "browser/brave/cookie", GENERIC_COOKIE_FIELDS
+    )
+
+    BrowserDownloadRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
+        "browser/brave/download", GENERIC_DOWNLOAD_RECORD_FIELDS + CHROMIUM_DOWNLOAD_RECORD_FIELDS
+    )
+
+    BrowserExtensionRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
+        "browser/brave/extension", GENERIC_EXTENSION_RECORD_FIELDS
+    )
+
+    @export(record=BrowserHistoryRecord)
+    def history(self) -> Iterator[BrowserHistoryRecord]:
+        """Return browser history records for Brave."""
+        yield from super().history("brave")
+
+    @export(record=BrowserCookieRecord)
+    def cookies(self) -> Iterator[BrowserCookieRecord]:
+        """Return browser cookie records for Brave."""
+        yield from super().cookies("brave")
+
+    @export(record=BrowserDownloadRecord)
+    def downloads(self) -> Iterator[BrowserDownloadRecord]:
+        """Return browser download records for Brave."""
+        yield from super().downloads("brave")
+
+    @export(record=BrowserExtensionRecord)
+    def extensions(self) -> Iterator[BrowserExtensionRecord]:
+        """Return browser extension records for Brave."""
+        yield from super().extensions("brave")

{dissect.target-3.16.dev20 → dissect.target-3.16.dev22}/dissect/target/plugins/apps/browser/chromium.py

@@ -1,3 +1,4 @@
+import itertools
 import json
 from collections import defaultdict
 from typing import Iterator, Optional
@@ -9,7 +10,7 @@ from dissect.util.ts import webkittimestamp
 
 from dissect.target.exceptions import FileNotFoundError, UnsupportedPluginError
 from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
-from dissect.target.helpers.fsutil import TargetPath
+from dissect.target.helpers.fsutil import TargetPath, join
 from dissect.target.helpers.record import create_extended_descriptor
 from dissect.target.plugin import export
 from dissect.target.plugins.apps.browser.browser import (
@@ -69,11 +70,12 @@ class ChromiumMixin:
                 users_dirs.append((user_details.user, cur_dir))
         return users_dirs
 
-    def _iter_db(self, filename: str) -> Iterator[SQLite3]:
+    def _iter_db(self, filename: str, subdirs: Optional[list[str]] = None) -> Iterator[SQLite3]:
         """Generate a connection to a sqlite database file.
 
         Args:
             filename: The filename as string of the database where the data is stored.
+            subdirs: Subdirectories to also try for every configured directory.
 
         Yields:
             opened db_file (SQLite3)
@@ -83,7 +85,11 @@ class ChromiumMixin:
             SQLError: If the history file could not be opened.
         """
 
-        for user, cur_dir in self._build_userdirs(self.DIRS):
+        dirs = self.DIRS
+        if subdirs:
+            dirs.extend([join(dir, subdir) for dir, subdir in itertools.product(self.DIRS, subdirs)])
+
+        for user, cur_dir in self._build_userdirs(dirs):
             db_file = cur_dir.joinpath(filename)
             try:
                 yield user, db_file, sqlite3.SQLite3(db_file.open())
@@ -198,7 +204,7 @@ class ChromiumMixin:
                 is_http_only (bool): Cookie http only flag.
                 same_site (bool): Cookie same site flag.
         """
-        for user, db_file, db in self._iter_db("Cookies"):
+        for user, db_file, db in self._iter_db("Cookies", subdirs=["Network"]):
             try:
                 for cookie in db.table("cookies").rows():
                     yield self.BrowserCookieRecord(

{dissect.target-3.16.dev20 → dissect.target-3.16.dev22/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.16.dev20
+Version: 3.16.dev22
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.16.dev20 → dissect.target-3.16.dev22}/dissect.target.egg-info/SOURCES.txt

@@ -124,6 +124,7 @@ dissect/target/plugins/apps/av/sophos.py
 dissect/target/plugins/apps/av/symantec.py
 dissect/target/plugins/apps/av/trendmicro.py
 dissect/target/plugins/apps/browser/__init__.py
+dissect/target/plugins/apps/browser/brave.py
 dissect/target/plugins/apps/browser/browser.py
 dissect/target/plugins/apps/browser/chrome.py
 dissect/target/plugins/apps/browser/chromium.py
@@ -404,6 +405,7 @@ tests/plugins/apps/av/test_sophos.py
 tests/plugins/apps/av/test_symantec.py
 tests/plugins/apps/av/test_trendmicro.py
 tests/plugins/apps/browser/__init__.py
+tests/plugins/apps/browser/test_brave.py
 tests/plugins/apps/browser/test_chrome.py
 tests/plugins/apps/browser/test_chromium.py
 tests/plugins/apps/browser/test_edge.py

{dissect.target-3.16.dev20 → dissect.target-3.16.dev22}/tests/helpers/test_configutil.py

@@ -1,6 +1,7 @@
 import textwrap
 from io import StringIO
 from pathlib import Path
+from typing import Union
 
 import pytest
 
@@ -8,6 +9,7 @@ from dissect.target.helpers.configutil import (
     ConfigurationParser,
     Default,
     Indentation,
+    Json,
     ScopeManager,
     SystemD,
 )
@@ -227,3 +229,32 @@ def test_systemd_basic_syntax() -> None:
     parser.parse_file(StringIO(data.read_text()))
 
     assert parser.parsed_data == output
+
+
+@pytest.mark.parametrize(
+    "data_string, expected_data",
+    [
+        (r'{"data" : "value"}', {"data": "value"}),
+        (r'[{"data" : "value"}]', {"list_item0": {"data": "value"}}),
+        (
+            r'[{"data" : "value"}, {"data" : "value2"}]',
+            {"list_item0": {"data": "value"}, "list_item1": {"data": "value2"}},
+        ),
+        (
+            r'[{"data": [{"key1": "value1"}, {"key1": "value2"}]}]',
+            {
+                "list_item0": {
+                    "data": {
+                        "list_item0": {"key1": "value1"},
+                        "list_item1": {"key1": "value2"},
+                    },
+                },
+            },
+        ),
+    ],
+)
+def test_json_syntax(data_string: str, expected_data: Union[dict, list]) -> None:
+    parser = Json()
+    parser.parse_file(StringIO(data_string))
+
+    assert parser.parsed_data == expected_data

dissect.target-3.16.dev22/tests/plugins/apps/browser/test_brave.py

@@ -0,0 +1,47 @@
+from typing import Iterator
+
+import pytest
+
+from dissect.target import Target
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.apps.browser import brave
+from tests._utils import absolute_path
+
+
+@pytest.fixture
+def target_brave(target_win_users: Target, fs_win: VirtualFilesystem) -> Iterator[Target]:
+    base_path = "Users\\John\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Default"
+    files = [
+        ("History", "_data/plugins/apps/browser/chrome/History.sqlite"),
+        ("Preferences", "_data/plugins/apps/browser/chrome/windows/Preferences"),
+        ("Secure Preferences", "_data/plugins/apps/browser/chrome/windows/Secure Preferences"),
+        ("Network\\Cookies", "_data/plugins/apps/browser/chromium/Cookies.sqlite"),
+    ]
+
+    for filename, test_path in files:
+        fs_win.map_file("\\".join([base_path, filename]), absolute_path(test_path))
+
+    target_win_users.add_plugin(brave.BravePlugin)
+
+    yield target_win_users
+
+
+def test_brave_history(target_brave: Target) -> None:
+    records = list(target_brave.brave.history())
+    assert len(records) == 5
+
+
+def test_brave_downloads(target_brave: Target) -> None:
+    records = list(target_brave.brave.downloads())
+    assert len(records) == 1
+
+
+def test_brave_extensions(target_brave: Target) -> None:
+    records = list(target_brave.brave.extensions())
+    assert len(records) == 8
+
+
+def test_brave_cookies(target_brave: Target) -> None:
+    records = list(target_brave.brave.cookies())
+    assert len(records) == 5
+    assert all(record.host == ".tweakers.net" for record in records)

{dissect.target-3.16.dev20 → dissect.target-3.16.dev22}/tests/plugins/general/test_config.py

@@ -69,7 +69,8 @@ def test_collapse_types(
     [
         ("ini", b"[DEFAULT]\nkey=value"),
         ("xml", b"<a>currently_just_text</a>"),
-        ("json", b"currently_just_text"),
+        ("json", b'{"key": "value"}'),
+        ("yaml", b"key: value"),
         ("cnf", b"key=value"),
         ("conf", b"key value"),
         ("sample", b"currently_just_text"),