mihari 4.8.0 → 4.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3e827da38142045be9b680636eb69b61d18e465b83f33d3a2a435c251041c7fc
-  data.tar.gz: 91d0c1fa7e50512c9a2bb8aceb914f69bec149c3fd7dc16f136a4b391a086e56
+  metadata.gz: 85756e55047ef3bde95c50c1ac3c474adbd29828bf1f95618f3aac85638a1752
+  data.tar.gz: babe64cf74a96f659057b06ac3b5864b6faa2c3ec9b7e3f0f9b57bce7dd635a8
 SHA512:
-  metadata.gz: c6c06c7d217091158d3fc354ccf3e0640494cfcd26b38cf5927d4d2a43f961ce8d2bf7d87bc965037554e745bf54b7dcf06e02b96d93962e6b0948bff11119d7
-  data.tar.gz: 5dd97d8c4a4d9ae9eac0e3823e8da97210de5dae87c448f48f6df565a12c99e7f0620d0477862762465aa77b0727912ccc935cd941e9a291a48a763fbf9ab8f3
+  metadata.gz: 5c15c65a8952c1fbcf695feba8add8a7fc962eaac9ca426a18dd510663573dc9fe6b27472ca0edcd1ff9fb86b68a49ce8c459e3a7d90eabe9dbbe1e4506181d8
+  data.tar.gz: aceb04f0f6e78af7f0df2293d78a4d4d20bcf1827e70d45e3f425e38b128c5f9194dbdac608b29b44852af77b626ccbdd03583e7170d5330a2b584c7cbdca55b

data/README.md

@@ -44,7 +44,6 @@ Mihari supports the following services by default.
 - [Pulsedive](https://pulsedive.com/)
 - [SecurityTrails](https://securitytrails.com/)
 - [Shodan](https://shodan.io)
-- [Spyse](https://spyse.com)
 - [urlscan.io](https://urlscan.io)
 - [VirusTotal](http://virustotal.com) & [VirusTotal Intelligence](https://www.virustotal.com/gui/intelligence-overview)
 - [ZoomEye](https://zoomeye.org)

data/lib/mihari/analyzers/rule.rb

@@ -18,7 +18,6 @@ module Mihari
       "pulsedive" => Pulsedive,
       "securitytrails" => SecurityTrails,
       "shodan" => Shodan,
-      "spyse" => Spyse,
       "st" => SecurityTrails,
       "urlscan" => Urlscan,
       "virustotal_intelligence" => VirusTotalIntelligence,

data/lib/mihari/commands/search.rb

@@ -14,7 +14,11 @@ module Mihari
             rule = Structs::Rule.from_path_or_id path_or_id
 
             # validate
-            rule.validate!
+            begin
+              rule.validate!
+            rescue RuleValidationError
+              return
+            end
 
             # check update
             id = rule.id
@@ -23,7 +27,9 @@ module Mihari
               with_db_connection do
                 rule_ = Mihari::Rule.find(id)
                 next if rule.yaml == rule_.yaml
-                return unless yes?("This operation will overwrite the rule in the database (Rule ID: #{id}). Are you sure you want to update the rule? (yes/no)")
+                unless yes?("This operation will overwrite the rule in the database (Rule ID: #{id}). Are you sure you want to update the rule? (yes/no)")
+                  return
+                end
               rescue ActiveRecord::RecordNotFound
                 next
               end

data/lib/mihari/schemas/analyzer.rb

@@ -58,13 +58,6 @@ module Mihari
       optional(:options).hash(AnalyzerOptions)
     end
 
-    Spyse = Dry::Schema.Params do
-      required(:analyzer).value(Types::String.enum("spyse"))
-      required(:query).value(:string)
-      required(:type).value(Types::String.enum("ip", "domain"))
-      optional(:options).hash(AnalyzerOptions)
-    end
-
     ZoomEye = Dry::Schema.Params do
       required(:analyzer).value(Types::String.enum("zoomeye"))
       required(:query).value(:string)

data/lib/mihari/schemas/rule.rb

@@ -22,7 +22,9 @@ module Mihari
       optional(:created_on).value(:date)
       optional(:updated_on).value(:date)
 
-      required(:queries).value(:array).each { AnalyzerWithoutAPIKey | AnalyzerWithAPIKey | Censys | CIRCL | PassiveTotal | Spyse | ZoomEye | Urlscan | Crtsh | Feed }
+      required(:queries).value(:array).each do
+        AnalyzerWithoutAPIKey | AnalyzerWithAPIKey | Censys | CIRCL | PassiveTotal | ZoomEye | Urlscan | Crtsh | Feed
+      end
 
       optional(:emitters).value(:array).each { Emitter | MISP | TheHive | Slack | HTTP }
 
@@ -57,9 +59,7 @@ module Mihari
 
       rule(:disallowed_data_values) do
         value.each do |v|
-          unless valid_disallowed_data_value?(v)
-            key.failure("#{v} is not a valid format.")
-          end
+          key.failure("#{v} is not a valid format.") unless valid_disallowed_data_value?(v)
         end
       end
     end

data/lib/mihari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mihari
-  VERSION = "4.8.0"
+  VERSION = "4.9.0"
 end

data/lib/mihari.rb

@@ -235,7 +235,6 @@ require "mihari/analyzers/passivetotal"
 require "mihari/analyzers/pulsedive"
 require "mihari/analyzers/securitytrails"
 require "mihari/analyzers/shodan"
-require "mihari/analyzers/spyse"
 require "mihari/analyzers/urlscan"
 require "mihari/analyzers/virustotal_intelligence"
 require "mihari/analyzers/virustotal"

data/mihari.gemspec

@@ -45,7 +45,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "vcr", "~> 6.1"
   spec.add_development_dependency "webmock", "~> 3.18"
 
-  spec.add_dependency "activerecord", "7.0.3.1"
+  spec.add_dependency "activerecord", "7.0.4"
   spec.add_dependency "addressable", "2.8.1"
   spec.add_dependency "awrence", "2.0.1"
   spec.add_dependency "binaryedge", "0.1.0"
@@ -55,10 +55,10 @@ Gem::Specification.new do |spec|
   spec.add_dependency "dnstwister", "0.1.0"
   spec.add_dependency "dotenv", "2.8.1"
   spec.add_dependency "dry-configurable", "0.15.0"
-  spec.add_dependency "dry-container", "0.10.1"
-  spec.add_dependency "dry-files", "0.2.0"
+  spec.add_dependency "dry-container", "0.11.0"
+  spec.add_dependency "dry-files", "0.3.0"
   spec.add_dependency "dry-initializer", "3.1.1"
-  spec.add_dependency "dry-schema", "1.10.2"
+  spec.add_dependency "dry-schema", "1.10.5"
   spec.add_dependency "dry-struct", "1.4.0"
   spec.add_dependency "dry-validation", "1.8.1"
   spec.add_dependency "email_address", "0.2.4"
@@ -92,12 +92,12 @@ Gem::Specification.new do |spec|
   spec.add_dependency "shodanx", "0.2.1"
   spec.add_dependency "slack-notifier", "2.4.0"
   spec.add_dependency "spysex", "0.2.0"
-  spec.add_dependency "sqlite3", "1.4.4"
+  spec.add_dependency "sqlite3", "1.5.0"
   spec.add_dependency "thor", "1.2.1"
   spec.add_dependency "urlscan", "0.8.0"
   spec.add_dependency "uuidtools", "2.2.0"
   spec.add_dependency "virustotalx", "1.2.0"
   spec.add_dependency "whois", "5.1.0"
-  spec.add_dependency "whois-parser", "1.2.0"
+  spec.add_dependency "whois-parser", "2.0.0"
   spec.add_dependency "zoomeye-rb", "0.2.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mihari
 version: !ruby/object:Gem::Version
-  version: 4.8.0
+  version: 4.9.0
 platform: ruby
 authors:
 - Manabu Niseki
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2022-08-28 00:00:00.000000000 Z
+date: 2022-10-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -254,14 +254,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.3.1
+        version: 7.0.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 7.0.3.1
+        version: 7.0.4
 - !ruby/object:Gem::Dependency
   name: addressable
   requirement: !ruby/object:Gem::Requirement
@@ -394,28 +394,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.10.1
+        version: 0.11.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.10.1
+        version: 0.11.0
 - !ruby/object:Gem::Dependency
   name: dry-files
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.2.0
+        version: 0.3.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.2.0
+        version: 0.3.0
 - !ruby/object:Gem::Dependency
   name: dry-initializer
   requirement: !ruby/object:Gem::Requirement
@@ -436,14 +436,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.10.2
+        version: 1.10.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.10.2
+        version: 1.10.5
 - !ruby/object:Gem::Dependency
   name: dry-struct
   requirement: !ruby/object:Gem::Requirement
@@ -912,14 +912,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.4.4
+        version: 1.5.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.4.4
+        version: 1.5.0
 - !ruby/object:Gem::Dependency
   name: thor
   requirement: !ruby/object:Gem::Requirement
@@ -996,14 +996,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.2.0
+        version: 2.0.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 1.2.0
+        version: 2.0.0
 - !ruby/object:Gem::Dependency
   name: zoomeye-rb
   requirement: !ruby/object:Gem::Requirement
@@ -1074,7 +1074,6 @@ files:
 - lib/mihari/analyzers/rule.rb
 - lib/mihari/analyzers/securitytrails.rb
 - lib/mihari/analyzers/shodan.rb
-- lib/mihari/analyzers/spyse.rb
 - lib/mihari/analyzers/urlscan.rb
 - lib/mihari/analyzers/virustotal.rb
 - lib/mihari/analyzers/virustotal_intelligence.rb

data/lib/mihari/analyzers/spyse.rb

@@ -1,93 +0,0 @@
-# frozen_string_literal: true
-
-require "spyse"
-
-module Mihari
-  module Analyzers
-    class Spyse < Base
-      param :query
-
-      option :type, default: proc { "domain" }
-
-      # @return [String, nil]
-      attr_reader :api_key
-
-      def initialize(*args, **kwargs)
-        super(*args, **kwargs)
-
-        @api_key = kwargs[:api_key] || Mihari.config.spyse_api_key
-      end
-
-      def artifacts
-        search || []
-      end
-
-      private
-
-      def search_params
-        @search_params ||= JSON.parse(query)
-      end
-
-      def configuration_keys
-        %w[spyse_api_key]
-      end
-
-      def api
-        @api ||= ::Spyse::API.new(api_key)
-      end
-
-      #
-      # Check whether a type is valid or not
-      #
-      # @return [Boolean]
-      #
-      def valid_type?
-        %w[ip domain cert].include? type
-      end
-
-      #
-      # Domain search
-      #
-      # @return [Array<Mihari::Artifact>]
-      #
-      def domain_search
-        res = api.domain.search(search_params, limit: 100)
-        items = res.dig("data", "items") || []
-        items.map do |item|
-          data = item["name"]
-          Artifact.new(data: data, source: source, metadata: item)
-        end
-      end
-
-      #
-      # IP search
-      #
-      # @return [Array<Mihari::Artifact>]
-      #
-      def ip_search
-        res = api.ip.search(search_params, limit: 100)
-        items = res.dig("data", "items") || []
-        items.map do |item|
-          data = item["ip"]
-          Artifact.new(data: data, source: source, metadata: item)
-        end
-      end
-
-      #
-      # IP/domain search
-      #
-      # @return [Array<Mihari::Artifact>]
-      #
-      def search
-        case type
-        when "domain"
-          domain_search
-        when "ip"
-          ip_search
-        else
-          raise InvalidInputError, "#{query}(type: #{type || "unknown"}) is not supported." unless valid_type?
-        end
-      end
-    end
-  end
-end