Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add SQLite parser for iOS Accounts (Accounts3.sqlite) file #4926

Open
wants to merge 12 commits into
base: main
Choose a base branch
from

Conversation

studiawan
Copy link
Contributor

@studiawan studiawan commented Nov 26, 2024

One line description of pull request

Add SQLite parser for iOS Accounts (Accounts3.sqlite) file

Description:

I add/edit several files:

  • Add import ios_accounts to plaso/parsers/sqlite_plugins/init.py
  • Add a new parser plugin ios_accounts.py to plaso/parsers/sqlite_plugins/
  • Add Accounts3.db file to plaso/test_data/
  • Add unit test ios_accounts.py to plaso/tests/parsers/sqlite_plugins/
  • Modify ios.yaml to support iOS account parser plugin (plaso/data/formatters/ios.yaml)
  • Modify timeliner.yaml to support iOS account parser plugin (plaso/data/timeliner.yaml)
  • Add sqlite/ios_accounts in enabled_parser_names (tests/cli/pinfo_tool.py)

Related issue (if applicable): fixes #4135

Notes:

All contributions to Plaso undergo code review.
This makes sure that the code has appropriate test coverage and conforms to the
Plaso style guide.

One of the maintainers will examine your code, and may request changes. Check off the items below in
order, and then a maintainer will review your code.

Checklist:

  • Automated checks (GitHub Actions, AppVeyor) pass
  • No new new dependencies are required or l2tdevtools has been updated
  • Reviewer assigned

@studiawan
Copy link
Contributor Author

studiawan commented Nov 27, 2024

Hi @joachimmetz, I am not sure why test_docs / build (3.12, docs) failed. Can you show me where the error is? Other eight tests are successful.
Thanks a lot.

@joachimmetz
Copy link
Member

@studiawan I'm a bit preoccupied at the moment will try to take a look as soon as time permits

@joachimmetz joachimmetz self-assigned this Feb 23, 2025
self.username = None
self.identifier = None
self.owning_bundle_id = None

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

style guide nit: have 2 empty lines

"""Retrieves a date and time value from the row.

Args:
query_hash (int): hash of the query, that uniquely
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

style guide nit: have 2 indentation spaces

"""iOS accounts event data.

Attributes:
date (dfdatetime.DateTimeValues): date and time the account
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

for consistency across the codebase changing this to creation_time

account_type (str): account type.
username (str): user name.
identifier (str): identifier.
owning_bundle_id (str): owning bundle identifier of the app
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

style guide nit: id => identifier

Copy link

codecov bot commented Feb 23, 2025

Codecov Report

Attention: Patch coverage is 97.14286% with 1 line in your changes missing coverage. Please review.

Project coverage is 85.06%. Comparing base (9d4e13c) to head (5b6106f).

Files with missing lines Patch % Lines
plaso/parsers/sqlite_plugins/ios_accounts.py 97.14% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4926      +/-   ##
==========================================
+ Coverage   85.05%   85.06%   +0.01%     
==========================================
  Files         431      432       +1     
  Lines       38648    38683      +35     
==========================================
+ Hits        32873    32907      +34     
- Misses       5775     5776       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add SQLite parser plugin for iOS Accounts
2 participants