TypeError: 'datetime.datetime' object is not subscriptable in iTunesBackupInfo.py when purchaseDate is a plist date type
- Dominant language
- Python
- Stars
- 1.2k
- Forks
- 303
- Avg merge
- 4h 32m
- Merged PRs (30d)
- 216
Description
## Description
`itunes_backup_installed_applications` in `scripts/artifacts/iTunesBackupInfo.py` crashes when an app's `iTunesMetadata` → `com.apple.iTunesStore.downloadInfo` → `purchaseDate` value is decoded by `plistlib` as a native `datetime.datetime` object rather than an ISO-8601 string.
The code assumes `purchaseDate` is always a string and slices off the trailing `Z`:
```python
purchase_date = download_info.get('purchaseDate', '')
if purchase_date:
purchase_date = purchase_date[:-1].replace('T', ' ')
```
`datetime.datetime` objects aren't subscriptable, so this raises a `TypeError` and halts the whole parse run.
This appears to depend on how the specific backup encoded the `` tag in the embedded `iTunesMetadata` plist — some backups store it as a string, others as a proper plist date, which `plistlib.loads()` auto-converts to `datetime.datetime`. I hit this consistently on an old iOS 12.3 iTunes backup.
## Steps to Reproduce
1. Parse an iTunes backup (iOS 12.3 in my case) via CLI: `python ileapp.py -t itunes -i -o `
2. `itunes_backup_installed_applications` runs and crashes on the first app whose `iTunesMetadata` encodes `purchaseDate` as a plist date type.
## Traceback
```
Traceback (most recent call last):
File "C:\iLEAPP\ileapp.py", line 607, in
main()
File "C:\iLEAPP\ileapp.py", line 361, in main
crunch_artifacts(selected_plugins, extracttype, input_path, out_params, wrap_text, loader, casedata, time_offset,
profile_filename, itunes_backup_password)
File "C:\iLEAPP\ileapp.py", line 466, in crunch_artifacts
loader["itunes_backup_installed_applications"].method([info_plist_path], report_folder, seeker, wrap_text, time_offset)
File "C:\iLEAPP\scripts\ilapfuncs.py", line 534, in wrapper
data_headers, data_list, source_path = func(Context)
File "C:\iLEAPP\scripts\artifacts\iTunesBackupInfo.py", line 124, in itunes_backup_installed_applications
purchase_date = purchase_date[:-1].replace('T', ' ')
TypeError: 'datetime.datetime' object is not subscriptable
```
## Environment
- iLEAPP: running from source (`main` branch, as of ~Aug 2026)
- OS: Windows
- Python: 3.14
- Extraction type: iTunes backup (`-t itunes`)
- Source device iOS version: 12.3
## Suggested Fix
Type-check before slicing, since `purchase_date` may already be a `datetime.datetime`:
```python
purchase_date = download_info.get('purchaseDate', '')
if purchase_date:
if isinstance(purchase_date, datetime.datetime):
purchase_date = purchase_date.strftime('%Y-%m-%d %H:%M:%S')
else:
purchase_date = purchase_date[:-1].replace('T', ' ')
```
I've tested this locally against the failing backup and it resolves the crash while preserving existing behavior for backups where `purchaseDate` is a string.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.