bqm 1.3.0 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0d78da6d030479d62b8fc734bde08fddc8ff97ca4502855287cb543b1d5f50fd
-  data.tar.gz: 836675f08cab5fe97744eae3c4f53182e2bbc9928f099540e94c36af576f3b56
+  metadata.gz: 4a7ea69f913278933cdcbae6a764b166d7990931ce1f68c1264f3c0127f548ad
+  data.tar.gz: 65a2b6a2aa1e78864e48671a2f8b5e4ce395fa0eaead13ce3098806cc6391ce9
 SHA512:
-  metadata.gz: 8d3f43f194866b90855ec27c36dfecdd3ba5131b424616f08eaf7ac0f75c02975d92553ae02f0f807246cfe61fd198ee2da06f6068b0e3d0e9c284f57ec41eca
-  data.tar.gz: fa5e9708365a8ac529c0a67b8c46bbc3aa901c91dac6d01b706d390c1211a534887eedcfaf31cfcbe0fd3350e4f5d9b1d1047fb6303e1543c7a4ec38d9b9079b
+  metadata.gz: be95aaeccf71fb47aac6179e3be127d5d456fc88e4f67b1798b46dfafcf24cba0220cc6c5569fba98acbd24b9ca2f6bde71adb2604e9b0d9e2e4afeb56bb743f
+  data.tar.gz: c752dc0e0d790b2b9e5337d5622cf05fd5d553558d7c3cb6654829ad54d8fb88157849e4d70c5a55589327c136dd2d442a857089d244923062953ba6b3a06f83

data/bin/bqm

@@ -14,7 +14,8 @@ def find_dataset
   raise IOError, "The dataset file #{source_file} does not exist or is unreadable."
 end
 
-def merge(source)
+# Merge remote sets defined in data/query-sets.json
+def merge_remote(source)
   sets = get_datasets(source)
   queries = []
   sets.each do |s|
@@ -25,6 +26,24 @@ def merge(source)
   queries
 end
 
+# Merge local sets provided by the user
+def merge_local(sources)
+  queries = []
+  sources.each do |source|
+    if File.file?(source) && File.readable?(source)
+      begin
+        data = JSON.load_file(source)
+      rescue NoMethodError # ruby 2.7 retro-compatibility
+        data = JSON.parse(File.read(source))
+      end
+      queries += data['queries']
+    else
+      raise IOError, "The dataset file #{source} does not exist or is unreadable."
+    end
+  end
+  queries
+end
+
 # Query class just for the sake of having custom comparison
 class BQMquery
   attr_accessor :data
@@ -72,14 +91,20 @@ if __FILE__ == $PROGRAM_NAME
   source = find_dataset
 
   require 'optparse'
-  options = {}
+  options = {
+    :'local-sets' => []
+  }
   OptionParser.new do |parser|
     parser.banner = 'Usage: bqm [options]'
 
     parser.on('-o', '--output-path PATH', 'Path where to store the query file')
     parser.on('-l', '--list', 'List available datasets')
+    parser.on('-i', '--local-sets FILE,...', Array, 'Local custom queries files') do |f|
+      options[:'local-sets'] += f
+    end
     parser.separator ''
     parser.separator 'Example: bqm -o ~/.config/bloodhound/customqueries.json'
+    parser.separator 'Example: bqm -o /tmp/customqueries.json -i /tmp/a.json,/tmp/b.json'
   end.parse!(into: options)
 
   out = options[:'output-path']
@@ -95,16 +120,20 @@ if __FILE__ == $PROGRAM_NAME
     if File.file?(out) && File.readable?(out)
       puts "[+] The output path #{out} already exists"
       puts '[?] Do you want to overwrite it? [y/n]'
-      if gets.chomp == 'y'
+      if STDIN.gets.chomp == 'y'
         puts '[?] What to do with the existing queries? (merge / discard) [m/d]'
-        flags[:merge_actual] = true if gets.chomp == 'm'
+        flags[:merge_actual] = true if STDIN.gets.chomp == 'm'
       else
         exit
       end
     end
     puts '[+] Fetching and merging datasets'
-    data = merge(source)
-    if flags[:merge_actual]
+    data = merge_remote(source)
+    local_set = options[:'local-sets']
+    if local_set
+      data += merge_local(local_set)
+    end
+    if flags[:'merge_actual']
       puts '[+] Merging your existing queries'
       data += JSON.parse(File.read(out))['queries']
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bqm
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.4.0
 platform: ruby
 authors:
 - Alexandre ZANNI
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-02-27 00:00:00.000000000 Z
+date: 2023-06-26 00:00:00.000000000 Z
 dependencies: []
 description: Deduplicate custom BloudHound queries from different datasets and merge
   them in one customqueries.json file.
@@ -26,6 +26,8 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/Acceis/bqm/issues
+  changelog_uri: https://github.com/Acceis/bqm/releases
+  documentation_uri: https://acceis.github.io/bqm/
   homepage_uri: https://github.com/Acceis/bqm
   source_code_uri: https://github.com/Acceis/bqm/
   rubygems_mfa_required: 'true'