abrignoni / abrignoni/iLEAPP

TypeError: 'datetime.datetime' object is not subscriptable in iTunesBackupInfo.py when purchaseDate is a plist date type

Đang mở
#1,950 0 bình luận 0 reaction 0 người được giao Xem trên GitHub
Ngôn ngữ chính
Python
Star
1.2k
Fork
303
Merge trung bình
4 giờ 32 phút
Pull request đã merge (30 ngày)
216

Mô tả

## Description

`itunes_backup_installed_applications` in `scripts/artifacts/iTunesBackupInfo.py` crashes when an app's `iTunesMetadata` → `com.apple.iTunesStore.downloadInfo` → `purchaseDate` value is decoded by `plistlib` as a native `datetime.datetime` object rather than an ISO-8601 string.

The code assumes `purchaseDate` is always a string and slices off the trailing `Z`:

```python
purchase_date = download_info.get('purchaseDate', '')
if purchase_date:
purchase_date = purchase_date[:-1].replace('T', ' ')
```

`datetime.datetime` objects aren't subscriptable, so this raises a `TypeError` and halts the whole parse run.

This appears to depend on how the specific backup encoded the `` tag in the embedded `iTunesMetadata` plist — some backups store it as a string, others as a proper plist date, which `plistlib.loads()` auto-converts to `datetime.datetime`. I hit this consistently on an old iOS 12.3 iTunes backup.

## Steps to Reproduce

1. Parse an iTunes backup (iOS 12.3 in my case) via CLI: `python ileapp.py -t itunes -i -o `
2. `itunes_backup_installed_applications` runs and crashes on the first app whose `iTunesMetadata` encodes `purchaseDate` as a plist date type.

## Traceback

```
Traceback (most recent call last):
File "C:\iLEAPP\ileapp.py", line 607, in
main()
File "C:\iLEAPP\ileapp.py", line 361, in main
crunch_artifacts(selected_plugins, extracttype, input_path, out_params, wrap_text, loader, casedata, time_offset,
profile_filename, itunes_backup_password)
File "C:\iLEAPP\ileapp.py", line 466, in crunch_artifacts
loader["itunes_backup_installed_applications"].method([info_plist_path], report_folder, seeker, wrap_text, time_offset)
File "C:\iLEAPP\scripts\ilapfuncs.py", line 534, in wrapper
data_headers, data_list, source_path = func(Context)
File "C:\iLEAPP\scripts\artifacts\iTunesBackupInfo.py", line 124, in itunes_backup_installed_applications
purchase_date = purchase_date[:-1].replace('T', ' ')
TypeError: 'datetime.datetime' object is not subscriptable
```

## Environment

- iLEAPP: running from source (`main` branch, as of ~Aug 2026)
- OS: Windows
- Python: 3.14
- Extraction type: iTunes backup (`-t itunes`)
- Source device iOS version: 12.3

## Suggested Fix

Type-check before slicing, since `purchase_date` may already be a `datetime.datetime`:

```python
purchase_date = download_info.get('purchaseDate', '')
if purchase_date:
if isinstance(purchase_date, datetime.datetime):
purchase_date = purchase_date.strftime('%Y-%m-%d %H:%M:%S')
else:
purchase_date = purchase_date[:-1].replace('T', ' ')
```

I've tested this locally against the failing backup and it resolves the crash while preserving existing behavior for backups where `purchaseDate` is a string.

Hướng dẫn đóng góp

Chưa lập chỉ mục được hướng dẫn đóng góp cho kho mã nguồn này

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.