* fix(cookie_extract): close world-readable window on temp cookie copy
_query_cookies_db copies the browser cookie DB (live X auth_token/ct0 session
secrets) into a system temp file, then chmods it 0600. But shutil.copy2 copies
the source file's mode onto the destination: Firefox cookies.sqlite is commonly
0644 (looser on WSL /mnt/c mounts), so between the copy and the chmod the
decrypted secrets sat world-readable in shared /tmp, race-readable by another
local user.
Use shutil.copyfile, which writes content only and leaves the 0600 perms that
mkstemp created intact, so the copy is never readable by others. The existing
chmod is kept as defense-in-depth.
Adds a regression test asserting the temp copy is 0600 the instant it exists,
before the lock chmod runs.
* test(cookie_extract): skip world-readable test on Windows
mkstemp creates 0o666 (not 0o600) on Windows and the POSIX permission
exposure does not apply there (_lock_temp_cookie_copy already no-ops on nt),
so the 0o600 assertion would fail spuriously on a Windows CI runner. Matches
the skipif guard on the sibling test_temp_cookie_db_copy_is_owner_only.
* feat(cookies): support the full Chromium browser family on macOS
extract_browser_credentials() only wired Firefox/Chrome/Safari, so
FROM_BROWSER=brave silently fell back to Firefox/Safari and
FROM_BROWSER=auto never tried Brave - even though the cookie_extract
layer already supported Brave. The Chrome/Brave decryption core was
already fully parameterized, so generalize it into a registry and wire
Brave, Edge, Vivaldi, Opera, Arc, and Chromium through all three layers.
- chrome_cookies: CHROMIUM_BROWSER_PROFILES registry + generic
_find_chromium_cookies_db() and extract_chromium_browser_cookies_macos()
- cookie_extract: per-browser extractors, auto order, updated docstrings
- env: FROM_BROWSER accepts any Chromium browser; auto tries them all
- ui / CONFIGURATION / CHANGELOG: document the new browsers
- tests: new test_chromium_browsers.py; make the macOS auto test
hermetic by mocking the whole Chromium family, not just Chrome
Only Brave is verified end-to-end on real hardware; the others use the
standard Chromium profile paths and "<Browser> Safe Storage" Keychain
names and are covered by unit tests. The failure mode is safe: a wrong
path or service name returns None and falls through to the next browser.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(cookies): lazy Keychain fetch + Network/Cookies probing (review follow-up)
Addresses cross-model review findings (Claude + Codex adversarial passes) and
adds real-hardware verification for Edge.
- Probe both the modern `Default/Network/Cookies` layout (Chromium >= 96) and
the legacy flat `Default/Cookies` in _find_chromium_cookies_db, via a new
_profile_cookie_db helper. Covers installs that moved the cookie store into
the per-profile Network/ subdirectory.
- Fetch the macOS Keychain key lazily in _extract_chromium_cookies_macos -
only when an encrypted cookie actually needs decrypting. Previously the key
was fetched as soon as the DB existed, so FROM_BROWSER=auto could prompt for
every installed Chromium browser. Now only the browser holding the requested
cookie prompts (also benefits the existing Chrome/Brave paths).
- Tests: Network/Cookies finder coverage + three lazy-Keychain tests (no fetch
for plain values, no fetch when the cookie is absent, fetch+decrypt for v10).
- Docs: corrected the FROM_BROWSER=auto Keychain-prompt wording in
CONFIGURATION.md to match the lazy behavior.
Verified end-to-end on real hardware: both Brave and Microsoft Edge decrypt a
live v10 cookie through the new registry path; the Edge Keychain service name
("Microsoft Edge Safe Storage") and Default/Cookies path were confirmed against
the actual install.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* fix(cookies): route Chrome through the shared profile finder (review follow-up)
Addresses Greptile review: Chrome was the only browser still pinned to the
static `Default/Cookies` path while Brave and the new Chromium family gained
`Default/Network/Cookies` (Chromium >= 96) probing via _find_chromium_cookies_db.
On a modern Chrome install whose store moved to Network/Cookies, extraction
would silently return None. Chrome now resolves through the same finder, so it
picks up both layouts like everything else. CHROME_COOKIES_DB is kept as a
back-compat constant.
Also: clarifying comment on the intentional auto-order divergence between
env.extract_browser_credentials (silent browsers first, to avoid Keychain
prompts) and cookie_extract's standalone auto (Chromium-first).
Tests: the Chrome extraction tests now patch _find_chromium_cookies_db instead
of the CHROME_COOKIES_DB constant (hermetic regardless of install layout).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Trevin Chow <trevin@trevinchow.com>
* fix: Firefox cookie extraction falls back to non-default profiles on multi-profile setups
- _try_firefox_dir now scans every profile directory when the default
profile has no matching cookies, fixing X login detection on
multi-profile Firefox setups (macOS, Linux, WSL)
- Two new tests: non-default profile fallback, all-profiles-no-match
Fixes#498
* fix: simplify fallback tracking with counter instead of list; provide explicit profiles_ini in test
---------
Co-authored-by: Trevin Chow <trevin@trevinchow.com>
Add a pytest-discovered tests/conftest.py for the last30days scripts path and
remove duplicate per-file sys.path.insert boilerplate from tests.
Normalize affected imports to rely on the shared scripts path and remove the
now-unneeded E402 suppressions.
On WSL2, native Linux Firefox typically has no x.com cookies since users
browse in Windows. Chromium browsers (Edge, Chrome, Brave) encrypt cookies
with DPAPI/app-bound encryption, making them inaccessible without admin
privileges. Windows Firefox stores cookies unencrypted in SQLite, readable
directly through the /mnt/c mount.
The cookie extractor now detects WSL2 via /proc/version, locates Windows
Firefox profiles under /mnt/c/Users/*/AppData/Roaming/Mozilla/Firefox,
and falls back to them when Linux Firefox yields no results. Reports
source as "firefox-wsl" to distinguish from native.
Also fixes profile resolution priority: Install* sections (Firefox >= 67)
now take precedence over the legacy Default=1 flag, which could select a
stale profile on multi-profile installations.
Ilia Alshanetsky