"""A plugin to generate a list of domains visited."""

from urllib import parse as urlparse

from plaso.analysis import interface
from plaso.analysis import manager


class UniqueDomainsVisitedPlugin(interface.AnalysisPlugin):
    """A plugin to generate a list all domains visited.

    This plugin will extract domains from browser history events extracted by Plaso. The
    list produced can be used to quickly determine if there has been a visit to a site
    of interest, for example, a known phishing site.
    """

    NAME = "unique_domains_visited"

    _SUPPORTED_EVENT_DATA_TYPES = frozenset(
        [
            "chrome:history:file_downloaded",
            "chrome:history:page_visited",
            "firefox:downloads:download",
            "firefox:places:page_visited",
            "macos:lsquarantine",
            "msiecf:redirected",
            "msiecf:url",
            "msie:webcache:container",
            "opera:history",
            "safari:history:visit",
        ]
    )

    # pylint: disable=unused-argument
    def ExamineEvent(self, analysis_mediator, event, event_data, event_data_stream):
        """Analyzes an event and extracts domains from it.

        We only evaluate straightforward web history events, not visits which can
        be inferred by TypedURLs, cookies or other means.

        Args:
          analysis_mediator (AnalysisMediator): mediates interactions between
              analysis plugins and other components, such as storage and dfVFS.
          event (EventObject): event to examine.
          event_data (EventData): event data.
          event_data_stream (EventDataStream): event data stream.
        """
        if event_data.data_type not in self._SUPPORTED_EVENT_DATA_TYPES:
            return

        url = getattr(event_data, "url", None)
        if url:
            parsed_url = urlparse.urlparse(url)
            domain = getattr(parsed_url, "netloc", None)
            if domain:
                self._analysis_counter[domain] += 1


manager.AnalysisPluginManager.RegisterPlugin(UniqueDomainsVisitedPlugin)
