Refactor Android backup password handling and add tests

tests/android_androidqf/test_sms.py

@@ -11,6 +11,8 @@ from mvt.common.module import run_module
 
 from ..utils import get_artifact_folder
 
+TEST_BACKUP_PASSWORD = "123456"
+
 
 class TestAndroidqfSMSAnalysis:
     def test_androidqf_sms(self):
@@ -21,3 +23,50 @@ class TestAndroidqfSMSAnalysis:
         assert len(m.results) == 2
         assert len(m.timeline) == 0
         assert len(m.detected) == 0
+
+    def test_androidqf_sms_encrypted_password_valid(self):
+        m = SMS(
+            target_path=os.path.join(get_artifact_folder(), "androidqf_encrypted"),
+            log=logging,
+            module_options={"backup_password": TEST_BACKUP_PASSWORD},
+        )
+        run_module(m)
+        assert len(m.results) == 1
+
+    def test_androidqf_sms_encrypted_password_prompt(self, mocker):
+        prompt_mock = mocker.patch(
+            "rich.prompt.Prompt.ask", return_value=TEST_BACKUP_PASSWORD
+        )
+        m = SMS(
+            target_path=os.path.join(get_artifact_folder(), "androidqf_encrypted"),
+            log=logging,
+            module_options={},
+        )
+        run_module(m)
+        assert prompt_mock.call_count == 1
+        assert len(m.results) == 1
+
+    def test_androidqf_sms_encrypted_password_invalid(self, caplog):
+        with caplog.at_level(logging.CRITICAL):
+            m = SMS(
+                target_path=os.path.join(get_artifact_folder(), "androidqf_encrypted"),
+                log=logging,
+                module_options={"backup_password": "invalid_password"},
+            )
+            run_module(m)
+        assert len(m.results) == 0
+        assert "Invalid backup password" in caplog.text
+
+    def test_androidqf_sms_encrypted_no_interactive(self, caplog):
+        with caplog.at_level(logging.CRITICAL):
+            m = SMS(
+                target_path=os.path.join(get_artifact_folder(), "androidqf_encrypted"),
+                log=logging,
+                module_options={"interactive": False},
+            )
+            run_module(m)
+        assert len(m.results) == 0
+        assert (
+            "Cannot decrypt backup because interactivity was disabled and the password was not supplied"
+            in caplog.text
+        )

tests/test_check_android_androidqf.py

@@ -12,9 +12,55 @@ from mvt.android.cli import check_androidqf
 from .utils import get_artifact_folder
 
 
+TEST_BACKUP_PASSWORD = "123456"
+
+
 class TestCheckAndroidqfCommand:
     def test_check(self):
         runner = CliRunner()
         path = os.path.join(get_artifact_folder(), "androidqf")
         result = runner.invoke(check_androidqf, [path])
         assert result.exit_code == 0
+
+    def test_check_encrypted_backup_prompt_valid(self, mocker):
+        """Prompt for password on CLI"""
+        prompt_mock = mocker.patch(
+            "rich.prompt.Prompt.ask", return_value=TEST_BACKUP_PASSWORD
+        )
+
+        runner = CliRunner()
+        path = os.path.join(get_artifact_folder(), "androidqf_encrypted")
+        result = runner.invoke(check_androidqf, [path])
+
+        assert prompt_mock.call_count == 1
+        assert result.exit_code == 0
+
+    def test_check_encrypted_backup_cli(self, mocker):
+        """Provide password as CLI argument"""
+        prompt_mock = mocker.patch(
+            "rich.prompt.Prompt.ask", return_value=TEST_BACKUP_PASSWORD
+        )
+
+        runner = CliRunner()
+        path = os.path.join(get_artifact_folder(), "androidqf_encrypted")
+        result = runner.invoke(
+            check_androidqf, ["--backup-password", TEST_BACKUP_PASSWORD, path]
+        )
+
+        assert prompt_mock.call_count == 0
+        assert result.exit_code == 0
+
+    def test_check_encrypted_backup_env(self, mocker):
+        """Provide password as environment variable"""
+        prompt_mock = mocker.patch(
+            "rich.prompt.Prompt.ask", return_value=TEST_BACKUP_PASSWORD
+        )
+
+        os.environ["MVT_ANDROID_BACKUP_PASSWORD"] = TEST_BACKUP_PASSWORD
+        runner = CliRunner()
+        path = os.path.join(get_artifact_folder(), "androidqf_encrypted")
+        result = runner.invoke(check_androidqf, [path])
+
+        assert prompt_mock.call_count == 0
+        assert result.exit_code == 0
+        del os.environ["MVT_ANDROID_BACKUP_PASSWORD"]