abrignoni / abrignoni/iLEAPP

TypeError: 'datetime.datetime' object is not subscriptable in iTunesBackupInfo.py when purchaseDate is a plist date type

Aperta
#1,950 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
Python
Stelle
1.2k
Fork
303
Merge medio
4h 32m
PR unite (30g)
216

Descrizione

## Description

`itunes_backup_installed_applications` in `scripts/artifacts/iTunesBackupInfo.py` crashes when an app's `iTunesMetadata` → `com.apple.iTunesStore.downloadInfo` → `purchaseDate` value is decoded by `plistlib` as a native `datetime.datetime` object rather than an ISO-8601 string.

The code assumes `purchaseDate` is always a string and slices off the trailing `Z`:

```python
purchase_date = download_info.get('purchaseDate', '')
if purchase_date:
purchase_date = purchase_date[:-1].replace('T', ' ')
```

`datetime.datetime` objects aren't subscriptable, so this raises a `TypeError` and halts the whole parse run.

This appears to depend on how the specific backup encoded the `` tag in the embedded `iTunesMetadata` plist — some backups store it as a string, others as a proper plist date, which `plistlib.loads()` auto-converts to `datetime.datetime`. I hit this consistently on an old iOS 12.3 iTunes backup.

## Steps to Reproduce

1. Parse an iTunes backup (iOS 12.3 in my case) via CLI: `python ileapp.py -t itunes -i -o `
2. `itunes_backup_installed_applications` runs and crashes on the first app whose `iTunesMetadata` encodes `purchaseDate` as a plist date type.

## Traceback

```
Traceback (most recent call last):
File "C:\iLEAPP\ileapp.py", line 607, in
main()
File "C:\iLEAPP\ileapp.py", line 361, in main
crunch_artifacts(selected_plugins, extracttype, input_path, out_params, wrap_text, loader, casedata, time_offset,
profile_filename, itunes_backup_password)
File "C:\iLEAPP\ileapp.py", line 466, in crunch_artifacts
loader["itunes_backup_installed_applications"].method([info_plist_path], report_folder, seeker, wrap_text, time_offset)
File "C:\iLEAPP\scripts\ilapfuncs.py", line 534, in wrapper
data_headers, data_list, source_path = func(Context)
File "C:\iLEAPP\scripts\artifacts\iTunesBackupInfo.py", line 124, in itunes_backup_installed_applications
purchase_date = purchase_date[:-1].replace('T', ' ')
TypeError: 'datetime.datetime' object is not subscriptable
```

## Environment

- iLEAPP: running from source (`main` branch, as of ~Aug 2026)
- OS: Windows
- Python: 3.14
- Extraction type: iTunes backup (`-t itunes`)
- Source device iOS version: 12.3

## Suggested Fix

Type-check before slicing, since `purchase_date` may already be a `datetime.datetime`:

```python
purchase_date = download_info.get('purchaseDate', '')
if purchase_date:
if isinstance(purchase_date, datetime.datetime):
purchase_date = purchase_date.strftime('%Y-%m-%d %H:%M:%S')
else:
purchase_date = purchase_date[:-1].replace('T', ' ')
```

I've tested this locally against the failing backup and it resolves the crash while preserving existing behavior for backups where `purchaseDate` is a string.

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.