firefox-plugin-artifacts

Parses Firefox browser's extensions.json file and retrieves information about installed extensions. Converts extension names, versions, descriptions, permissions, update URLs, and more into structured fields for output.

Command properties

Item	Description
Command type	Driver query
Required permission	None
License usage	Counted
Parallel execution	Not supported
Distributed execution	Runs on Data Node (mapper)

Syntax

firefox-plugin-artifacts [zippath=STR] [zipcharset=STR] FILE_PATH

Options

zippath=STR: Path to the ZIP file containing the extensions.json file. Use this to query files directly inside a ZIP archive.
zipcharset=STR: Character set for ZIP file entries (default: utf-8)

Target

FILE_PATH: Path to the Firefox extensions.json file to query. You can use a wildcard (*) to specify multiple files. This file is typically located at C:\Users\<username>\AppData\Roaming\Mozilla\Firefox\Profiles\<profile>\extensions.json.

Output fields

Field	Type	Description
`name`	string	Extension name
`version`	string	Extension version
`description`	string	Extension description
`minimum_browser_version`	string	Minimum browser version required by the extension
`permissions`	array	List of permissions required by the extension
`update_url`	string	Extension update URL (converted from `sourceURI`)
`avg_rating`	string	Average rating of the extension
`contributor_url`	string	Contribution URL
`full_description`	string	Full description of the extension
`homepage_url`	string	Homepage URL
`review_count`	string	Number of reviews
`review_url`	string	Review page URL
`support_url`	string	Support page URL
`weekly_download`	string	Weekly download count
`updated`	timestamp	Last update time

In addition to the above fields, all key-value pairs in the addons entries of extensions.json are also assigned as output fields.

Error codes

Parse errors

N/A

Runtime errors

N/A

Description

The firefox-plugin-artifacts command parses Firefox browser's extensions.json file as JSON and outputs each item in the addons array as a record.

Values from the defaultLocale key (name, description, etc.) are merged into the top-level record. The minVersion of the first item in the targetApplications array is assigned to the minimum_browser_version field. The permissions array from userPermissions is assigned to the permissions field.

The keys sourceURI, averageRating, contributionURL, fullDescription, homepageURL, reviewCount, reviewURL, supportURL, weeklyDownloads, and updateDate are converted and output as update_url, avg_rating, contributor_url, full_description, homepage_url, review_count, review_url, support_url, weekly_download, and updated respectively.

The updated field is converted from Long type to timestamp type when applicable. If JSON parsing fails, the file is skipped and the next file is processed.

Examples

Retrieve the Firefox extension list
```
firefox-plugin-artifacts /opt/logpresso/evidence/extensions.json
```
Retrieves the list of Firefox extensions.
Retrieve extensions from multiple profiles using a wildcard
```
firefox-plugin-artifacts /opt/logpresso/evidence/*/extensions.json
```
Retrieves extension files from multiple profile directories at once.
Query an extensions.json file inside a ZIP archive
```
firefox-plugin-artifacts zippath=/opt/logpresso/evidence/artifacts.zip Profile/extensions.json
```
Retrieves extension information from the extensions.json file inside the ZIP archive.

Filter extensions with specific permissions

firefox-plugin-artifacts /opt/logpresso/evidence/extensions.json
| search contains(strjoin(",", permissions), "webRequest")

Filters only extensions that require the webRequest permission.