'#2351 Adds suport for XML formatted plist files and shortens metadata

names of timestamps.
sepinf-inc · Oct 29, 2024 · c36fc03 · c36fc03
1 parent f7cc003
commit c36fc03
Show file tree

Hide file tree

Showing 3 changed files with 31 additions and 22 deletions.
diff --git a/iped-app/resources/config/conf/MakePreviewConfig.txt b/iped-app/resources/config/conf/MakePreviewConfig.txt
@@ -11,4 +11,4 @@ supportedMimes = application/x-prefetch; text/x-vcard; application/x-emule-prefe
 
 # List of mimetypes which parsers insert links to other case items into preview
 supportedMimesWithLinks = application/x-emule; application/x-emule-part-met; application/x-ares-galaxy; application/x-shareaza-library-dat; application/x-shareaza-download; application/x-bittorrent-resume-dat; application/x-bittorrent-resume-dat-entry; application/x-bittorrent
-supportedMimesWithLinks = application/x-bplist; application/x-apple-nskeyedarchiver
+supportedMimesWithLinks = application/x-bplist; application/x-apple-nskeyedarchiver; application/x-plist; application/x-bplist-webarchive; application/x-plist-webarchive; application/x-plist-memgraph; application/x-bplist-memgraph; application/x-bplist-itunes; application/x-plist-itunes
diff --git a/...sers/iped-parsers-impl/src/main/java/iped/parsers/plist/parser/NSKeyedArchiverParser.java b/...sers/iped-parsers-impl/src/main/java/iped/parsers/plist/parser/NSKeyedArchiverParser.java
@@ -25,8 +25,6 @@
 import com.dd.plist.UID;
 
 import iped.parsers.plist.detector.PListDetector;
-import iped.parsers.util.MetadataUtil;
-import iped.utils.DateUtil;
 import iped.utils.IOUtil;
 
 public class NSKeyedArchiverParser extends PListParser {
@@ -230,12 +228,7 @@ private void parseObject(String name, NSObject object, NSArray objects, Set<NSOb
 
     private void parseNSTime(NSObject nso, XHTMLContentHandler xhtml, Metadata metadata, String path, EmbeddedDocumentExtractor extractor, ParseContext context) throws SAXException {
         Date date = new Date((((NSNumber) nso).longValue() + 978307200) * 1000);
-        xhtml.startElement("li", "class", "nochild");
-        xhtml.characters(nso.toString() + "(" + DateUtil.dateToString(date) + ")");
-        xhtml.endElement("li");
-        MetadataUtil.setMetadataType(path, Date.class);
-        String dateStr = DateUtil.dateToString(date);
-        metadata.add(path, dateStr);
+        parseDate(date, path, xhtml, metadata);
     }
 
     public void parseKADictionary(String name, UID uid, NSObject obj, NSArray objects, Set<NSObject> alreadyVisitedObjects, XHTMLContentHandler xhtml, Metadata metadata, String path,

diff --git a/iped-parsers/iped-parsers-impl/src/main/java/iped/parsers/plist/parser/PListParser.java b/iped-parsers/iped-parsers-impl/src/main/java/iped/parsers/plist/parser/PListParser.java
@@ -4,8 +4,10 @@
 import java.io.InputStream;
 import java.nio.charset.Charset;
 import java.text.ParseException;
+import java.util.Arrays;
 import java.util.Collections;
 import java.util.Date;
+import java.util.HashSet;
 import java.util.Map.Entry;
 import java.util.Set;
 
@@ -52,7 +54,8 @@
  */
 public class PListParser extends AbstractParser {
 
-    private static final Set<MediaType> SUPPORTED_TYPES = Collections.singleton(BPListDetector.BPLIST);
+    private static final Set<MediaType> SUPPORTED_TYPES = Collections
+            .unmodifiableSet(new HashSet<>(Arrays.asList(BPListDetector.BITUNES, BPListDetector.BMEMGRAPH, BPListDetector.BPLIST, BPListDetector.BWEBARCHIVE, BPListDetector.PLIST)));
     private static final String BPLIST_METADATA_SUFFIX = "bplist";
 
     private static final String CSS = new String(readResourceAsBytes("/iped/parsers/css/treeview.css"), Charset.forName("UTF-8"));
@@ -83,10 +86,19 @@ public void parse(InputStream is, ContentHandler handler, Metadata metadata, Par
                 xhtml.characters(PListParser.CSS);
                 xhtml.endElement("style");
 
+                String contentType = metadata.get(Metadata.CONTENT_TYPE);
+                if (BPListDetector.PLIST.toString().equals(contentType)) {
+                    if (oc instanceof NSDictionary) {
+                        MediaType subtype = BPListDetector.detectXMLOnKeys(((NSDictionary) oc).keySet());
+                        metadata.set(Metadata.CONTENT_TYPE, subtype.toString());
+                    }
+                }
+
                 try {
                     EmbeddedDocumentExtractor extractor = context.get(EmbeddedDocumentExtractor.class, new ParsingEmbeddedDocumentExtractor(context));
 
                     xhtml.startElement("nav");
+
                     parseNSObject(oc, xhtml, metadata, getBasePath(), extractor, context);
                     xhtml.endElement("nav");
                 } catch (Exception e) {
@@ -121,12 +133,7 @@ public boolean parseNSPrimitiveObject(NSObject nso, XHTMLContentHandler xhtml, M
                 try {
                     Date date = new Date(n.longValue() * 1000);
                     // check to see if it is a date information
-                    xhtml.startElement("li", "class", "nochild");
-                    xhtml.characters(nso.toString() + "(" + DateUtil.dateToString(date) + ")");
-                    xhtml.endElement("li");
-                    MetadataUtil.setMetadataType(path, Date.class);
-                    String dateStr = DateUtil.dateToString(date);
-                    metadata.add(path, dateStr);
+                    parseDate(date, path, xhtml, metadata);
                 } catch (Exception e) {
                     xhtml.startElement("li", "class", "nochild");
                     xhtml.characters(escapeEmpty(nso.toString()));
@@ -146,17 +153,26 @@ public boolean parseNSPrimitiveObject(NSObject nso, XHTMLContentHandler xhtml, M
             return true;
         }
         if (nso instanceof NSDate) {
-            String dateStr = DateUtil.dateToString(((NSDate) nso).getDate());
-            xhtml.startElement("li", "class", "nochild");
-            xhtml.characters(dateStr);
-            xhtml.endElement("li");
-            MetadataUtil.setMetadataType(path, Date.class);
-            metadata.add(path, dateStr);
+            parseDate(((NSDate) nso).getDate(), path, xhtml, metadata);
             return true;
         }
         return false;
     }
 
+    public void parseDate(Date date, String path, XHTMLContentHandler xhtml, Metadata metadata) throws SAXException {
+        String dateStr = DateUtil.dateToString(date);
+        xhtml.startElement("li", "class", "nochild");
+        xhtml.characters(dateStr);
+        xhtml.endElement("li");
+        String metadataName = getBasePath() + ":" + path.substring(path.lastIndexOf(":") + 1);
+        MetadataUtil.setMetadataType(metadataName, Date.class);
+        String currentValue = metadata.get(metadataName);
+        if (currentValue == null || (currentValue.length() + dateStr.length()) <= 32765) {
+            metadata.add(metadataName, dateStr);
+        }
+
+    }
+
     public String escapeEmpty(String str) {
         // this method was implemented to avoid empty content inside tag was causing CSS
         // not to correctly apply