har2tree 1.31.3__py3-none-any.whl → 1.31.5__py3-none-any.whl

har2tree/nodes.py

@@ -15,13 +15,15 @@ from base64 import b64decode
 from datetime import datetime, timedelta
 from functools import lru_cache, cached_property
 from hashlib import sha256
-from io import BytesIO
+from io import BytesIO, StringIO
 from pathlib import Path
 from typing import Any
 from collections.abc import MutableMapping
-from urllib.parse import unquote_plus, urlparse, urljoin
+from urllib.parse import unquote_plus, urlparse, urljoin, parse_qs
 
 import filetype  # type: ignore
+import json_stream  # type: ignore
+
 from bs4 import BeautifulSoup
 from ete3 import TreeNode  # type: ignore
 from publicsuffixlist import PublicSuffixList  # type: ignore
@@ -211,32 +213,52 @@ class URLNode(HarTreeNode):
         if 'user_agent' not in self.features:
             self.add_feature('user_agent', '')
 
-        if 'method' in self.request and self.request['method'] == 'POST' and 'postData' in self.request:
-            # If the content is empty, we don't care
-            if self.request['postData']['text']:
-                _posted_data: str = self.request['postData']['text']
-                decoded_posted_data: str | bytes | int | float | bool
+        if 'method' in self.request and self.request['method'] == 'POST':
+            decoded_posted_data: list[Any] | str | bytes | int | float | bool | dict[str, str] | dict[str, list[str]] | None = None
+            if 'postData' not in self.request or 'text' not in self.request['postData']:
+                self.logger.debug('POST request with no content.')
+            elif not self.request['postData']['text']:
+                # If the POST content is empty
+                self.logger.debug('Empty POST request.')
+                decoded_posted_data = ''
+            elif self.request['postData'].get('params'):
+                # NOTE 2025-08-08
+                # if the posted data mimetype is "application/x-www-form-urlencoded"
+                # the HAR contains the decoded entry in the params key
+                # The params key is a list of dicts with a key and a value
+                #   {"name": <key>, "value": <data>}
+                # I'd rather have it as {<key>: <data>}
+                # TODO: some processing on the data part (it's often a json blob)
+                self.logger.debug('Got a params POST.')
+                decoded_posted_data = {entry['name']: entry['value'] for entry in self.request['postData']['params']}
+            else:
                 # NOTE 2023-08-22: Blind attempt to base64 decode the data
+                self.logger.debug('Got a normal POST')
                 try:
-                    decoded_posted_data = self._dirty_safe_b64decode(_posted_data)
+                    decoded_posted_data = self._dirty_safe_b64decode(self.request['postData']['text'])
                 except binascii.Error:
-                    decoded_posted_data = _posted_data
+                    decoded_posted_data = self.request['postData']['text']
                 if 'mimeType' in self.request['postData']:
                     # make it easier to compare.
                     mimetype_lower = self.request['postData']['mimeType'].lower()
                     if mimetype_lower.startswith('application/x-www-form-urlencoded'):
+                        # NOTE: this should never happen as there should
+                        # be something in self.request['postData']['params']
+                        # and we already processed it before but just in case...
+                        self.logger.debug('Got a application/x-www-form-urlencoded without params key')
                         # 100% sure there will be websites where decode will fail
                         try:
                             if isinstance(decoded_posted_data, bytes):
                                 decoded_posted_data = decoded_posted_data.decode()
                             if isinstance(decoded_posted_data, str):
                                 decoded_posted_data = unquote_plus(decoded_posted_data)
+                            if isinstance(decoded_posted_data, str):
+                                decoded_posted_data = parse_qs(decoded_posted_data)
                         except Exception as e:
-                            self.logger.warning(f'Unable to unquote form data "{decoded_posted_data!r}": {e}')
+                            self.logger.warning(f'Unable to unquote or parse form data "{decoded_posted_data!r}": {e}')
                     elif (mimetype_lower.startswith('application/json')
                           or mimetype_lower.startswith('application/csp-report')
                           or mimetype_lower.startswith('application/x-amz-json-1.1')
-                          or mimetype_lower.startswith('application/x-json-stream')
                           or mimetype_lower.startswith('application/reports+json')
                           or mimetype_lower.endswith('json')
                           ):
@@ -247,17 +269,34 @@ class URLNode(HarTreeNode):
                                 decoded_posted_data = json.loads(decoded_posted_data)
                             except Exception:
                                 if isinstance(decoded_posted_data, (str, bytes)):
-                                    self.logger.debug(f"Expected json, got garbage: {mimetype_lower} - {decoded_posted_data[:20]!r}[...]")
+                                    self.logger.warning(f"Expected json, got garbage: {mimetype_lower} - {decoded_posted_data[:20]!r}[...]")
                                 else:
-                                    self.logger.debug(f"Expected json, got garbage: {mimetype_lower} - {decoded_posted_data}")
-
+                                    self.logger.warning(f"Expected json, got garbage: {mimetype_lower} - {decoded_posted_data}")
+                    elif mimetype_lower.startswith('application/x-json-stream'):
+                        try:
+                            to_stream: StringIO | BytesIO
+                            if isinstance(decoded_posted_data, str):
+                                to_stream = StringIO(decoded_posted_data)
+                            elif isinstance(decoded_posted_data, bytes):
+                                to_stream = BytesIO(decoded_posted_data)
+                            else:
+                                raise ValueError(f'Invalid type: {type(decoded_posted_data)}')
+                            streamed_data = json_stream.load(to_stream)
+                            decoded_posted_data = json_stream.to_standard_types(streamed_data)
+                        except Exception:
+                            if isinstance(decoded_posted_data, (str, bytes)):
+                                self.logger.warning(f"Expected json stream, got garbage: {mimetype_lower} - {decoded_posted_data[:20]!r}[...]")
+                            else:
+                                self.logger.warning(f"Expected json stream, got garbage: {mimetype_lower} - {decoded_posted_data}")
                     elif mimetype_lower.startswith('multipart/form-data'):
                         # FIXME multipart content (similar to email). Not totally sure what do do with it tight now.
+                        self.logger.debug(f'Got a POST {mimetype_lower}: {decoded_posted_data!r}')
                         pass
                     elif mimetype_lower.startswith('application/x-protobuf'):
                         # FIXME If possible, decode?
+                        self.logger.debug(f'Got a POST {mimetype_lower}: {decoded_posted_data!r}')
                         pass
-                    elif mimetype_lower.startswith('text'):
+                    elif mimetype_lower.startswith('text') and isinstance(decoded_posted_data, (str, bytes)):
                         try:
                             # NOTE 2023-08-22: Quite a few text entries are in fact json, give it a shot.
                             # loads here may give us a int, float or a bool.
@@ -267,34 +306,48 @@ class URLNode(HarTreeNode):
                             pass
                     elif mimetype_lower.endswith('javascript'):
                         # keep it as it is
+                        self.logger.warning(f'Got a POST {mimetype_lower}: {decoded_posted_data!r}')
                         pass
                     elif mimetype_lower == '?':
                         # Just skip it, no need to go in the warnings
+                        self.logger.warning(f'Got a POST {mimetype_lower}: {decoded_posted_data!r}')
                         pass
-                    elif mimetype_lower in ['application/octet-stream', 'application/binary']:
+                    elif mimetype_lower == 'application/binary':
+                        # generally a broken gzipped blob
+                        self.logger.debug(f'Got a POST {mimetype_lower}, most probably a broken gziped blob: {decoded_posted_data!r}')
+                    elif mimetype_lower in ['application/octet-stream']:
                         # Should flag it, maybe?
+                        self.logger.warning(f'Got a POST {mimetype_lower}: {decoded_posted_data!r}')
                         pass
-                    elif mimetype_lower in ['application/unknown', 'application/grpc-web+proto']:
+                    elif mimetype_lower in ['application/grpc-web+proto']:
+                        # Can be decoded?
+                        self.logger.warning(f'Got a POST {mimetype_lower} - can be decoded: {decoded_posted_data!r}')
+                    elif mimetype_lower in ['application/unknown']:
                         # Weird but already seen stuff
+                        self.logger.warning(f'Got a POST {mimetype_lower}: {decoded_posted_data!r}')
                         pass
                     else:
                         self.logger.warning(f'Unexpected mime type: {mimetype_lower}')
+                else:
+                    self.logger.warning(f'Missing mimetype in POST: {self.request["postData"]}')
 
-                # NOTE 2023-08-22: Blind attempt to process the data as json
-                if isinstance(decoded_posted_data, (str, bytes)):
-                    try:
-                        decoded_posted_data = json.loads(decoded_posted_data)
-                    except Exception:
-                        pass
+            # NOTE 2023-08-22: Blind attempt to process the data as json
+            if isinstance(decoded_posted_data, (str, bytes)):
+                try:
+                    decoded_posted_data = json.loads(decoded_posted_data)
+                except Exception:
+                    pass
 
-                if isinstance(decoded_posted_data, bytes):
-                    # NOTE 2023-08-22: Blind attempt to decode the bytes
-                    # Try to decode it as utf-8
-                    try:
-                        decoded_posted_data = decoded_posted_data.decode('utf-8')
-                    except Exception:
-                        pass
-                self.add_feature('posted_data', decoded_posted_data)
+            if isinstance(decoded_posted_data, bytes):
+                # NOTE 2023-08-22: Blind attempt to decode the bytes
+                # Try to decode it as utf-8
+                try:
+                    decoded_posted_data = decoded_posted_data.decode('utf-8')
+                except Exception:
+                    pass
+            self.add_feature('posted_data', decoded_posted_data)
+            if 'postData' in self.request and self.request['postData'].get('mimeType'):
+                self.add_feature('posted_data_mimetype', self.request['postData']['mimeType'])
 
         self.add_feature('response', har_entry['response'])
         try:

{har2tree-1.31.3.dist-info → har2tree-1.31.5.dist-info}/METADATA

@@ -1,11 +1,11 @@
 Metadata-Version: 2.3
 Name: har2tree
-Version: 1.31.3
+Version: 1.31.5
 Summary: HTTP Archive (HAR) to ETE Toolkit generator
 License: BSD-3-Clause
 Author: Raphaël Vinot
 Author-email: raphael.vinot@circl.lu
-Requires-Python: >=3.9
+Requires-Python: >=3.9,<4.0
 Classifier: Intended Audience :: Information Technology
 Classifier: Intended Audience :: Science/Research
 Classifier: Intended Audience :: Telecommunications Industry
@@ -24,11 +24,13 @@ Requires-Dist: Sphinx (>=8.2.3) ; (python_version >= "3.11") and (extra == "docs
 Requires-Dist: beautifulsoup4[charset-normalizer,lxml] (>=4.13.4)
 Requires-Dist: ete3 (>=3.1.3)
 Requires-Dist: filetype (>=1.2.0)
+Requires-Dist: json-stream (>=2.3.3,<3.0.0)
 Requires-Dist: legacy-cgi (>=2.6.3) ; python_version >= "3.13,<4.0"
+Requires-Dist: multipart (>=1.3.0,<2.0.0)
 Requires-Dist: numpy (<2.1) ; python_version < "3.10"
 Requires-Dist: numpy (<2.3) ; python_version < "3.11"
-Requires-Dist: numpy (>=2.3.1) ; python_version >= "3.11"
-Requires-Dist: publicsuffixlist (>=1.0.2.20250719)
+Requires-Dist: numpy (>=2.3.2) ; python_version >= "3.11"
+Requires-Dist: publicsuffixlist (>=1.0.2.20250809)
 Requires-Dist: six (>=1.17.0) ; extra == "docs"
 Requires-Dist: tinycss2 (>=1.4.0)
 Requires-Dist: w3lib (>=2.3.1)

{har2tree-1.31.3.dist-info → har2tree-1.31.5.dist-info}/RECORD

@@ -1,10 +1,10 @@
 har2tree/__init__.py,sha256=Na3mxHkUBq3rzYbxiLNJF37DxH5mcghSorjzXw5Teug,422
 har2tree/har2tree.py,sha256=47x9X5tY69f9SXkYJgJsnAaX2kxgXHgzFThGz6M86Zw,44495
 har2tree/helper.py,sha256=CgeXqfBeHs8SbkW7TRNKqJBTZLAu63KggQjbGHCZAGI,20681
-har2tree/nodes.py,sha256=CC3NseEaM455JOpPqjfTAQ-dwWiGWmzlceGSSeTwoRo,28951
+har2tree/nodes.py,sha256=a-5tk_AbnIklbdujlesb_1E0KGnSyK0OsTnbnd5i0D4,32961
 har2tree/parser.py,sha256=4yej1OcVYAIiLfzYZsO9WCw3WyM_ykDTuvpW7UO1ROE,3645
 har2tree/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-har2tree-1.31.3.dist-info/LICENSE,sha256=Xa4EVROgJsEo10CW-ISCRiw0TtqdKz1JuM3BBLBM55c,1803
-har2tree-1.31.3.dist-info/METADATA,sha256=PSDu0bnPUYje8It-uyZfcDVbo4TTTC7RCzH-2CRAc0U,2112
-har2tree-1.31.3.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
-har2tree-1.31.3.dist-info/RECORD,,
+har2tree-1.31.5.dist-info/LICENSE,sha256=Xa4EVROgJsEo10CW-ISCRiw0TtqdKz1JuM3BBLBM55c,1803
+har2tree-1.31.5.dist-info/METADATA,sha256=5QfFL4ESUuWJn7JuxcnLSgw70q3MGZoDfe9PJFS5JkA,2203
+har2tree-1.31.5.dist-info/WHEEL,sha256=b4K_helf-jlQoXBBETfwnf4B04YC67LOev0jo4fX5m8,88
+har2tree-1.31.5.dist-info/RECORD,,