From cf88740f6a39ea0ccb2807b2eaefbfe0d49b3ffb Mon Sep 17 00:00:00 2001
From: tek <tek@randhome.io>
Date: Wed, 26 Jan 2022 14:50:34 +0100
Subject: [PATCH] Fixes bugs in SafariBrowserState module and add tests

---
 mvt/ios/modules/mixed/safari_browserstate.py  |  10 +++--
 .../3a47b0981ed7c10f3e2800aa66bac96a3b5db28e  | Bin 0 -> 40960 bytes
 tests/ios/test_safari_browserstate.py         |  36 ++++++++++++++++++
 3 files changed, 43 insertions(+), 3 deletions(-)
 create mode 100644 tests/artifacts/ios_backup/3a/3a47b0981ed7c10f3e2800aa66bac96a3b5db28e
 create mode 100644 tests/ios/test_safari_browserstate.py

diff --git a/mvt/ios/modules/mixed/safari_browserstate.py b/mvt/ios/modules/mixed/safari_browserstate.py
index 38de49f..97806e1 100644
--- a/mvt/ios/modules/mixed/safari_browserstate.py
+++ b/mvt/ios/modules/mixed/safari_browserstate.py
@@ -62,6 +62,7 @@ class SafariBrowserState(IOSExtraction):
                         self.detected.append(result)
 
     def _process_browser_state_db(self, db_path):
+        self._recover_sqlite_db_if_needed(db_path)
         conn = sqlite3.connect(db_path)
 
         cur = conn.cursor()
@@ -92,8 +93,12 @@ class SafariBrowserState(IOSExtraction):
             if row[4]:
                 # Skip a 4 byte header before the plist content.
                 session_plist = row[4][4:]
-                session_data = plistlib.load(io.BytesIO(session_plist))
-                session_data = keys_bytes_to_string(session_data)
+                session_data = {}
+                try:
+                    session_data = plistlib.load(io.BytesIO(session_plist))
+                    session_data = keys_bytes_to_string(session_data)
+                except plistlib.InvalidFileException:
+                    pass
 
                 if "SessionHistoryEntries" in session_data.get("SessionHistory", {}):
                     for session_entry in session_data["SessionHistory"].get("SessionHistoryEntries"):
@@ -114,7 +119,6 @@ class SafariBrowserState(IOSExtraction):
             })
 
     def run(self):
-
         if self.is_backup:
             for backup_file in self._get_backup_files_from_manifest(relative_path=SAFARI_BROWSER_STATE_BACKUP_RELPATH):
                 self.file_path = self._get_backup_file_from_id(backup_file["file_id"])
diff --git a/tests/artifacts/ios_backup/3a/3a47b0981ed7c10f3e2800aa66bac96a3b5db28e b/tests/artifacts/ios_backup/3a/3a47b0981ed7c10f3e2800aa66bac96a3b5db28e
new file mode 100644
index 0000000000000000000000000000000000000000..b27d5a27145d3836437c7622d7eded7c10d1a7e2
GIT binary patch
literal 40960
zcmeI(U2ob}7zc1WBw#XSRNW#jcH?S_8WfX2LlUxSQVp0WD}{y^tx+#52Om-^1`{8X
zEW2x0P1?o2&ZKFV`vTLXYQ5jZq-h^umpjKm0H>)?RE<UYTS39c56?ONoySgHo7zFi
z@`&7W+_vG#o5CGI6orSfEC_<cUW@ECTo%}y`QZxtEsnjv?yV%OfA!^3>>nW-y(@eu
z#eQ1)@q<s7eu)0O_*e9THDQ4O1Rwwb2tWV={{sOMjl|O{;tSF0nB;5EIMOMh)N(ph
z*Lyw79B*07S2eY+$@}Gk_Ea9<(vOuZ<%w2#mB;WbiHA}+es5Vk9QHEGPNTuBgKdLs
zR9^Knyi~%G_{xg->JygKCgZ)2zmE*E)zw@{3yj7x+0g6So>rBgRQDgN)kFD_b||Zj
zdS$=NKKEEF*OlRr<+}E?E|)9p)hLzZMtT3Bp(z6#-84Ky&Xp=Txu6x*MyVgA^g2za
z-F2BDF^7<TtWK?O$Yt-BS%)7^DaA@v+utkm0gcq;s#eshS~;)P_^!~t1cxbTC5_EQ
zUajTTg2r1KPYQf)1}%x5NI3pzMHGB+dTO(O_UcB@bNqFETue`ouSu_t=OgjuW$}C7
z>^oE5^+M2<&C67teDdCI=~<pl{7p*FwfiyoN~y$mqg-J-qA5K}T>Z?V78{9vU6A9N
zEXv=pE5eFxP>*FG=WIeet4$cGTAG|Rml&qiIkqhpdE_`JZNoj$$M$VBNluq^Se};a
zv~}C+oXELKWt1$X(C5xM%cS#+#0_rkxB7$8J*TVFrt8?Y?zCEzc$Xs|_11N*GlNar
zk?WjOmNuBrv}o5hE_jD*iaMrYI~}51ZR3~(L;VyCiH**5&izAja!!;$#Mtf+i*=$z
zuY@PYYjtufWrdQsTC|D#3*q?Z%kL;r>X#-BKM957Yir`6Uyy@ZrsT9oI!zK-ou4Sv
zz{b^%(I)H=K23bPE=G9D?>_Q#2F4p$otwxR*m&ckK=CfRqcg&2){UlToe|x1n!PsZ
zc!9dU5;rW8Y2!z6R6jFpHqR3^oc7OutejZg(O#4J(pJy5FLc{sB^?M(DK<GaniqQ4
zKXzIcJ4nxn%l~@3rJQBjWJeD_u=tr($yds?dR1j7WSO5Lbj~r@+5WlKKiMfVZ%-t?
zm<z`b)~>6Sz?|smKtqWAq2<^2!V-Ilv0nxDg9QQ*fB*y_009U<00Izz00bZafm<T5
zE-nfUNs^+HBoucuh0V=OF1elFEhIC!2ir;Y!S;4Co8Q{Xr+2cO>B1Jj!7s*s7uXLL
z2tWV=5P$##AOHafKmY;|fB*z;m%!?LLyAsw{m<|Jhho18vA<(~uwPgp009U<00Izz
z00bZa0SG_<0uZ<r0<lnNCCa|UG5od_jm(9Xc>}#GhSs8iF9P(R|JQ_=b}M!cgM<JC
zAOHafKmY;|fB*y_009WhPT)mWydyO3J$oia*rWGsX+*bDnws7$?j|#tLYh5$pUo!K
zOgfuP?WD4)Y_XWhYUy&VB3o2GGR)_m*QK9rY>>|SxpiW7iD?<@j(fbp*EU$3zUMl<
z?v!EbFE3Mnemq~B=Kg>G`TsXU?9J@>&@%)e009U<00Izz00bZa0SG_<0yh)5ADZs}
zAo}<JUkkC<H|qzVf&c^{009U<00Izz00bZa0SG`~Mgj?OL1+llG|wR5{{M{T2;D*e
z0uX=z1Rwwb2tWV=5P$##-h;rj_y2MI{~oZB0s;_#00bZa0SG_<0uX=z1RyXY0bKvj
g2p-)+00Izz00bZa0SG_<0uX=z1pY&TX|MnP1)k#O5C8xG

literal 0
HcmV?d00001

diff --git a/tests/ios/test_safari_browserstate.py b/tests/ios/test_safari_browserstate.py
new file mode 100644
index 0000000..a89ca55
--- /dev/null
+++ b/tests/ios/test_safari_browserstate.py
@@ -0,0 +1,36 @@
+# Mobile Verification Toolkit (MVT)
+# Copyright (c) 2021 The MVT Project Authors.
+# Use of this software is governed by the MVT License 1.1 that can be found at
+#   https://license.mvt.re/1.1/
+
+import logging
+
+from mvt.common.indicators import Indicators
+from mvt.common.module import run_module
+from mvt.ios.modules.mixed.safari_browserstate import SafariBrowserState
+
+from ..utils import get_backup_folder
+
+
+class TestSafariBrowserStateModule:
+    def test_parsing(self):
+        m = SafariBrowserState(base_folder=get_backup_folder(), log=logging, results=[])
+        m.is_backup = True
+        run_module(m)
+        assert m.file_path != None
+        assert len(m.results) == 1
+        assert len(m.timeline) == 1
+        assert len(m.detected) == 0
+
+    def test_detection(self, indicator_file):
+        m = SafariBrowserState(base_folder=get_backup_folder(), log=logging, results=[])
+        m.is_backup = True
+        ind = Indicators(log=logging)
+        ind.parse_stix2(indicator_file)
+        # Adds a file that exists in the manifest.
+        ind.ioc_files[0]["domains"].append("en.wikipedia.org")
+        m.indicators = ind
+        run_module(m)
+        assert len(m.detected) == 1
+        assert len(m.results) == 1
+        assert m.results[0]["tab_url"] == "https://en.wikipedia.org/wiki/NSO_Group"