Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This library is a fork of atomac. It was created to provide a release with python 3 support because there has not been a release since 2013
Atomacos is a library to enable GUI testing of macOS applications via the Apple Accessibility API. Atomacos has direct access to the API via pyobjc. It's fast and easy to use to write tests.
Requirements
On travis, it's only on 10.11 because we are able to enable accessibility API.
If you experience issues, please open a ticket in the issue tracker.
Check the checkbox:
System Preferences > Universal Access > Enable access for assistive devices
System Preferences > Security & Privacy > Privacy > Accessibility
Failure to enable this will result in AXErrorAPIDisabled
exceptions during some module usage.
For release
$ pip install atomacos
For pre-release
$ pip install --pre atomacos
Once installed, you should be able to use it to launch an application:
>>> import atomacos
>>> atomacos.launchAppByBundleId('com.apple.Automator')
This should launch Automator.
Next, get a reference to the UI Element for the application itself:
>>> automator = atomacos.getAppRefByBundleId('com.apple.Automator')
>>> automator
<atomacos.AXClasses.NativeUIElement AXApplication Automator>
Now, we can find objects in the accessibility hierarchy:
>>> window = automator.windows()[0]
>>> window.AXTitle
u'Untitled'
>>> sheet = window.sheets()[0]
Note that we retrieved an accessibility attribute from the Window object - AXTitle
.
Atomacos supports reading and writing of most attributes.
Xcode's included Accessibility Inspector
can provide a quick way to find these attributes.
There is a shortcut for getting the sheet object which bypasses accessing it through the Window object. Atomacos can search all objects in the hierarchy:
>>> sheet = automator.sheetsR()[0]
There are search methods for most types of accessibility objects.
Each search method, such as windows
,
has a corresponding recursive search function, such as windowsR
.
The recursive search finds items that aren't just direct children, but children of children.
These search methods can be given terms to identify specific elements.
Note that *
and ?
can be used as wildcard match characters in all search methods:
>>> close = sheet.buttons('Close')[0]
There are methods to search for UI Elements that match any number of criteria. The criteria are accessibility attributes:
>>> close = sheet.findFirst(AXRole='AXButton', AXTitle='Close')
findFirst
and findFirstR
return the first item found to match the criteria or None
.
findAll
and findAllR
return a list of all items that match the criteria or an empty list([]
).
Objects are fairly versatile. You can get a list of supported attributes and actions on an object:
>>> close.getAttributes()
[u'AXRole', u'AXRoleDescription', u'AXHelp', u'AXEnabled', u'AXFocused',
u'AXParent', u'AXWindow', u'AXTopLevelUIElement', u'AXPosition', u'AXSize',
u'AXTitle']
>>> close.AXTitle
u'Close'
>>> close.getActions()
[u'Press']
Performing an action is as natural as:
>>> close.Press()
Any action can be triggered this way.
FAQs
Automated Testing on macOS
We found that atomacos demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.