abrignoni / abrignoni/iLEAPP

TypeError: 'datetime.datetime' object is not subscriptable in iTunesBackupInfo.py when purchaseDate is a plist date type

Abierto
#1,950 0 comentarios 0 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
Python
Estrellas
1.2k
Forks
303
Merge medio
4 h 32 min
PR fusionados (30 d)
216

Descripción

## Description

`itunes_backup_installed_applications` in `scripts/artifacts/iTunesBackupInfo.py` crashes when an app's `iTunesMetadata` → `com.apple.iTunesStore.downloadInfo` → `purchaseDate` value is decoded by `plistlib` as a native `datetime.datetime` object rather than an ISO-8601 string.

The code assumes `purchaseDate` is always a string and slices off the trailing `Z`:

```python
purchase_date = download_info.get('purchaseDate', '')
if purchase_date:
purchase_date = purchase_date[:-1].replace('T', ' ')
```

`datetime.datetime` objects aren't subscriptable, so this raises a `TypeError` and halts the whole parse run.

This appears to depend on how the specific backup encoded the `` tag in the embedded `iTunesMetadata` plist — some backups store it as a string, others as a proper plist date, which `plistlib.loads()` auto-converts to `datetime.datetime`. I hit this consistently on an old iOS 12.3 iTunes backup.

## Steps to Reproduce

1. Parse an iTunes backup (iOS 12.3 in my case) via CLI: `python ileapp.py -t itunes -i -o `
2. `itunes_backup_installed_applications` runs and crashes on the first app whose `iTunesMetadata` encodes `purchaseDate` as a plist date type.

## Traceback

```
Traceback (most recent call last):
File "C:\iLEAPP\ileapp.py", line 607, in
main()
File "C:\iLEAPP\ileapp.py", line 361, in main
crunch_artifacts(selected_plugins, extracttype, input_path, out_params, wrap_text, loader, casedata, time_offset,
profile_filename, itunes_backup_password)
File "C:\iLEAPP\ileapp.py", line 466, in crunch_artifacts
loader["itunes_backup_installed_applications"].method([info_plist_path], report_folder, seeker, wrap_text, time_offset)
File "C:\iLEAPP\scripts\ilapfuncs.py", line 534, in wrapper
data_headers, data_list, source_path = func(Context)
File "C:\iLEAPP\scripts\artifacts\iTunesBackupInfo.py", line 124, in itunes_backup_installed_applications
purchase_date = purchase_date[:-1].replace('T', ' ')
TypeError: 'datetime.datetime' object is not subscriptable
```

## Environment

- iLEAPP: running from source (`main` branch, as of ~Aug 2026)
- OS: Windows
- Python: 3.14
- Extraction type: iTunes backup (`-t itunes`)
- Source device iOS version: 12.3

## Suggested Fix

Type-check before slicing, since `purchase_date` may already be a `datetime.datetime`:

```python
purchase_date = download_info.get('purchaseDate', '')
if purchase_date:
if isinstance(purchase_date, datetime.datetime):
purchase_date = purchase_date.strftime('%Y-%m-%d %H:%M:%S')
else:
purchase_date = purchase_date[:-1].replace('T', ' ')
```

I've tested this locally against the failing backup and it resolves the crash while preserving existing behavior for backups where `purchaseDate` is a string.

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.