mihari 5.4.3 → 5.4.5

data/lib/mihari/services/rule_proxy.rb

@@ -1,11 +1,6 @@
 # frozen_string_literal: true
 
-require "date"
-require "erb"
 require "json"
-require "pathname"
-require "securerandom"
-require "yaml"
 
 module Mihari
   module Services
@@ -29,10 +24,9 @@ module Mihari
       #
       def initialize(data)
         @data = data.deep_symbolize_keys
-
         @errors = nil
 
-        validate
+        validate!
       end
 
       #
@@ -44,21 +38,14 @@ module Mihari
         !@errors.empty?
       end
 
-      def validate
+      def validate!
         contract = Schemas::RuleContract.new
         result = contract.call(data)
 
         @data = result.to_h
         @errors = result.errors
-      end
 
-      def validate!
-        return unless errors?
-
-        Mihari.logger.error "Failed to parse the input as a rule:"
-        Mihari.logger.error JSON.pretty_generate(errors.to_h)
-
-        raise RuleValidationError, errors
+        raise ValidationError.new("Validation failed", errors) if errors?
       end
 
       def [](key)
@@ -178,9 +165,7 @@ module Mihari
         # @return [Mihari::Services::Rule]
         #
         def from_yaml(yaml)
-          Services::RuleProxy.new YAML.safe_load(ERB.new(yaml).result, permitted_classes: [Date, Symbol])
-        rescue Psych::SyntaxError => e
-          raise YAMLSyntaxError, e.message
+          new YAML.safe_load(ERB.new(yaml).result, permitted_classes: [Date, Symbol])
         end
 
         #
@@ -189,48 +174,7 @@ module Mihari
         # @return [Mihari::Services::Rule]
         #
         def from_model(model)
-          Services::RuleProxy.new model.data
-        end
-
-        #
-        # Load a rule from path
-        #
-        # @param [String] path
-        #
-        # @return [Mihari::Services::Rule, nil]
-        #
-        def from_path(path)
-          return nil unless Pathname(path).exist?
-
-          from_yaml File.read(path)
-        end
-
-        #
-        # Load a rule from DB
-        #
-        # @param [String] id
-        #
-        # @return [Mihari::Services::Rule, nil]
-        #
-        def from_id(id)
-          return nil unless Mihari::Rule.exists?(id)
-
-          Services::RuleProxy.from_model Mihari::Rule.find(id)
-        end
-
-        #
-        # @param [String] path_or_id Path to YAML file or YAML string or ID of a rule in the database
-        #
-        # @return [Mihari::Services::Rule]
-        #
-        def from_path_or_id(path_or_id)
-          rule = from_path(path_or_id)
-          return rule unless rule.nil?
-
-          rule = from_id(path_or_id)
-          return rule unless rule.nil?
-
-          raise ArgumentError, "#{path_or_id} does not exist"
+          new model.data
         end
       end
     end

data/lib/mihari/services/rule_runner.rb

@@ -3,6 +3,8 @@
 module Mihari
   module Services
     class RuleRunner
+      include Dry::Monads[:result, :try]
+
       include Mixins::ErrorNotification
 
       # @return [Mihari::Services::RuleProxy]
@@ -38,11 +40,14 @@ module Mihari
       # @return [Mihari::Alert, nil]
       #
       def run
-        analyzer = rule.analyzer
+        rule.analyzer.run
+      end
 
-        with_error_notification do
-          analyzer.run
-        end
+      #
+      # @return [Dry::Monads::Result::Success<Mihari::Alert, nil>, Dry::Monads::Result::Failure]
+      #
+      def result
+        Try[StandardError] { run }.to_result
       end
     end
   end

data/lib/mihari/structs/binaryedge.rb

@@ -0,0 +1,89 @@
+module Mihari
+  module Structs
+    module BinaryEdge
+      class Target < Dry::Struct
+        attribute :ip, Types::String
+
+        #
+        # @return [String]
+        #
+        def ip
+          attributes[:ip]
+        end
+
+        class << self
+          def from_dynamic!(d)
+            d = Types::Hash[d]
+            new(
+              ip: d.fetch("ip")
+            )
+          end
+        end
+      end
+
+      class Event < Dry::Struct
+        attribute :target, Target
+
+        #
+        # @return [Target]
+        #
+        def target
+          attributes[:target]
+        end
+
+        class << self
+          def from_dynamic!(d)
+            d = Types::Hash[d]
+            new(
+              target: Target.from_dynamic!(d.fetch("target"))
+            )
+          end
+        end
+      end
+
+      class Response < Dry::Struct
+        # @!attribute [r] page
+        # @return [Integer]
+        attribute :page, Types::Integer
+
+        # @!attribute [r] pagesize
+        # @return [Integer]
+        attribute :pagesize, Types::Integer
+
+        # @!attribute [r] total
+        # @return [Integer]
+        attribute :total, Types::Integer
+
+        # @!attribute [r] events
+        # @return [Array<Event>]
+        attribute :events, Types.Array(Event)
+
+        #
+        # @return [Array<Event>]
+        #
+        def events
+          attributes[:events]
+        end
+
+        #
+        # @return [Array<Artifact>]
+        #
+        def artifacts
+          events.map { |event| Artifact.new(data: event.target.ip) }
+        end
+
+        class << self
+          def from_dynamic!(d)
+            d = Types::Hash[d]
+            new(
+              page: d.fetch("page"),
+              pagesize: d.fetch("pagesize"),
+              total: d.fetch("total"),
+              events: d.fetch("events").map { |x| Event.from_dynamic!(x) }
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/lib/mihari/structs/shodan.rb

@@ -140,7 +140,7 @@ module Mihari
         end
       end
 
-      class Result < Dry::Struct
+      class Response < Dry::Struct
         attribute :matches, Types.Array(Match)
         attribute :total, Types::Int
 
@@ -197,6 +197,7 @@ module Mihari
         def artifacts
           matches.map do |match|
             metadata = collect_metadata_by_ip(match.ip_str)
+
             ports = collect_ports_by_ip(match.ip_str).map do |port|
               Mihari::Port.new(port: port)
             end

data/lib/mihari/structs/urlscan.rb

@@ -85,9 +85,7 @@ module Mihari
         #
         def artifacts
           values = [page.url, page.domain, page.ip].compact
-          values.map do |value|
-            Mihari::Artifact.new(data: value, metadata: metadata)
-          end
+          values.map { |value| Mihari::Artifact.new(data: value, metadata: metadata) }
         end
 
         class << self

data/lib/mihari/structs/virustotal_intelligence.rb

@@ -21,9 +21,7 @@ module Mihari
           #
           def from_dynamic!(d)
             d = Types::Hash[d]
-            new(
-              url: d["url"]
-            )
+            new(url: d["url"])
           end
         end
       end

data/lib/mihari/type_checker.rb

@@ -54,7 +54,7 @@ module Mihari
       return "ip" if ip?
       return "domain" if domain?
       return "url" if url?
-      return "mail" if mail?
+      "mail" if mail?
     end
 
     # @return [String, nil]

data/lib/mihari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mihari
-  VERSION = "5.4.3"
+  VERSION = "5.4.5"
 end

data/lib/mihari/web/endpoints/alerts.rb

@@ -54,18 +54,27 @@ module Mihari
           requires :id, type: Integer
         end
         delete "/:id" do
+          extend Dry::Monads[:result, :try]
+
           id = params["id"].to_i
 
-          begin
+          result = Try do
             alert = Mihari::Alert.find(id)
-          rescue ActiveRecord::RecordNotFound
-            error!({ message: "ID:#{id} is not found" }, 404)
-          end
+            alert.destroy
+          end.to_result
 
-          alert.destroy
+          if result.success?
+            status 204
+            return present({ message: "" }, with: Entities::Message)
+          end
 
-          status 204
-          present({ message: "" }, with: Entities::Message)
+          failure = result.failure
+          case failure
+          when ActiveRecord::RecordNotFound
+            error!({ message: "ID:#{id} is not found" }, 404)
+          else
+            raise failure
+          end
         end
 
         desc "Create an alert", {
@@ -77,17 +86,26 @@ module Mihari
           requires :artifacts, type: Array, documentation: { type: String, is_array: true, param_type: "body" }
         end
         post "/" do
-          proxy = Services::AlertProxy.new(params.to_snake_keys)
-          runner = Services::AlertRunner.new(proxy)
+          extend Dry::Monads[:result, :try]
 
-          begin
-            alert = runner.run
-          rescue ActiveRecord::RecordNotFound
-            error!({ message: "Rule:#{params["ruleId"]} is not found" }, 404)
+          result = Try do
+            proxy = Services::AlertProxy.new(params.to_snake_keys)
+            runner = Services::AlertRunner.new(proxy)
+            runner.run
+          end.to_result
+
+          if result.success?
+            status 201
+            return present(result.value!, with: Entities::Alert)
           end
 
-          status 201
-          present alert, with: Entities::Alert
+          failure = result.failure
+          case failure
+          when ActiveRecord::RecordNotFound
+            error!({ message: "Rule:#{params["ruleId"]} is not found" }, 404)
+          else
+            raise failure
+          end
         end
       end
     end

data/lib/mihari/web/endpoints/artifacts.rb

@@ -13,9 +13,11 @@ module Mihari
           requires :id, type: Integer
         end
         get "/:id" do
+          extend Dry::Monads[:result, :try]
+
           id = params[:id].to_i
 
-          begin
+          result = Try do
             artifact = Mihari::Artifact.includes(
               :autonomous_system,
               :geolocation,
@@ -23,18 +25,25 @@ module Mihari
               :dns_records,
               :reverse_dns_names
             ).find(id)
-          rescue ActiveRecord::RecordNotFound
-            error!({ message: "ID:#{id} is not found" }, 404)
-          end
+            # TODO: improve queries
+            alert_ids = Mihari::Artifact.where(data: artifact.data).pluck(:alert_id)
+            tag_ids = Mihari::Tagging.where(alert_id: alert_ids).pluck(:tag_id)
+            tag_names = Mihari::Tag.where(id: tag_ids).distinct.pluck(:name)
 
-          # TODO: improve queries
-          alert_ids = Mihari::Artifact.where(data: artifact.data).pluck(:alert_id)
-          tag_ids = Mihari::Tagging.where(alert_id: alert_ids).pluck(:tag_id)
-          tag_names = Mihari::Tag.where(id: tag_ids).distinct.pluck(:name)
+            artifact.tags = tag_names
 
-          artifact.tags = tag_names
+            artifact
+          end.to_result
 
-          present artifact, with: Entities::Artifact
+          return present(result.value!, with: Entities::Artifact) if result.success?
+
+          failure = result.failure
+          case failure
+          when ActiveRecord::RecordNotFound
+            error!({ message: "ID:#{id} is not found" }, 404)
+          else
+            raise failure
+          end
         end
 
         desc "Enrich an artifact", {
@@ -46,9 +55,11 @@ module Mihari
           requires :id, type: Integer
         end
         get "/:id/enrich" do
+          extend Dry::Monads[:result, :try]
+
           id = params["id"].to_i
 
-          begin
+          result = Try do
             artifact = Mihari::Artifact.includes(
               :autonomous_system,
               :geolocation,
@@ -58,15 +69,23 @@ module Mihari
               :cpes,
               :ports
             ).find(id)
-          rescue ActiveRecord::RecordNotFound
-            error!({ message: "ID:#{id} is not found" }, 404)
-          end
 
-          artifact.enrich_all
-          artifact.save
+            artifact.enrich_all
+            artifact.save
+          end.to_result
 
-          status 201
-          present({ message: "" }, with: Entities::Message)
+          if result.success?
+            status 201
+            return present({ message: "" }, with: Entities::Message)
+          end
+
+          failure = result.failure
+          case failure
+          when ActiveRecord::RecordNotFound
+            error!({ message: "ID:#{id} is not found" }, 404)
+          else
+            raise failure
+          end
         end
 
         desc "Delete an artifact", {
@@ -78,18 +97,27 @@ module Mihari
           requires :id, type: Integer
         end
         delete "/:id" do
+          extend Dry::Monads[:result, :try]
+
           id = params["id"].to_i
 
-          begin
+          result = Try do
             alert = Mihari::Artifact.find(id)
-          rescue ActiveRecord::RecordNotFound
-            error!({ message: "ID:#{id} is not found" }, 404)
-          end
+            alert.destroy
+          end.to_result
 
-          alert.destroy
+          if result.success?
+            status 204
+            return present({ message: "" }, with: Entities::Message)
+          end
 
-          status 204
-          present({ message: "" }, with: Entities::Message)
+          failure = result.failure
+          case failure
+          when ActiveRecord::RecordNotFound
+            error!({ message: "ID:#{id} is not found" }, 404)
+          else
+            raise failure
+          end
         end
       end
     end

data/lib/mihari/web/endpoints/configs.rb

@@ -10,9 +10,9 @@ module Mihari
           summary: "Get configs"
         }
         get "/" do
-          configs = (Mihari.analyzers + Mihari.emitters + Mihari.enrichers).map do |klass|
+          configs = (Mihari.analyzers + Mihari.emitters + Mihari.enrichers).filter_map do |klass|
             Mihari::Structs::Config.from_class(klass)
-          end.compact
+          end
 
           present(configs, with: Entities::Config)
         end

data/lib/mihari/web/endpoints/ip_addresses.rb

@@ -16,11 +16,9 @@ module Mihari
           ip = params[:ip].to_s
 
           data = Enrichers::IPInfo.query(ip)
-          if data.nil?
-            error!({ message: "IP:#{ip} is not found" }, 404)
-          else
-            present data, with: Entities::IPAddress
-          end
+          error!({ message: "IP:#{ip} is not found" }, 404) if data.nil?
+
+          present data, with: Entities::IPAddress
         end
       end
     end