mihari 5.7.0 → 5.7.2

data/lib/mihari/enrichers/ipinfo.rb

@@ -28,7 +28,7 @@ module Mihari
       #
       # @param [String] ip
       #
-      # @return [Mihari::Structs::IPInfo::Response, nil]
+      # @return [Mihari::Structs::IPInfo::Response]
       #
       def call(ip)
         url = "https://ipinfo.io/#{ip}/json"

data/lib/mihari/entities/tag.rb

@@ -3,6 +3,7 @@
 module Mihari
   module Entities
     class Tag < Grape::Entity
+      expose :id, documentation: { type: Integer, required: true }
       expose :name, documentation: { type: String, required: true }
     end
 

data/lib/mihari/http.rb

@@ -9,14 +9,13 @@ module Mihari
     #
     class BetterError < ::HTTP::Feature
       def wrap_response(response)
-        unless response.status.success?
-          raise StatusCodeError.new(
-            "Unsuccessful response code returned: #{response.code}",
-            response.code,
-            response.body.to_s
-          )
-        end
-        response
+        return response if response.status.success?
+
+        raise StatusCodeError.new(
+          "Unsuccessful response code returned: #{response.code}",
+          response.code,
+          response.body.to_s
+        )
       end
 
       def on_error(_request, error)
@@ -35,12 +34,15 @@ module Mihari
         #
         # @param [Integer, nil] timeout
         # @param [Hash] headers
+        # @param [Boolean] raise_exception
         #
         # @return [::HTTP::Client]
         #
-        def build(headers: {}, timeout: nil)
-          client = ::HTTP.use(:better_error).headers(headers)
-          client.timeout(timeout) unless timeout.nil?
+        # @param [Object] raise_exception
+        def build(headers: {}, timeout: nil, raise_exception: true)
+          client = raise_exception ? ::HTTP.use(:better_error) : ::HTTP
+          client = client.headers(headers)
+          client = client.timeout(timeout) unless timeout.nil?
           client
         end
       end

data/lib/mihari/rule.rb

@@ -218,6 +218,20 @@ module Mihari
       )
     end
 
+    #
+    # @return [Boolean]
+    #
+    def diff?
+      model = Mihari::Models::Rule.find(id)
+      model.data != data.deep_stringify_keys
+    rescue ActiveRecord::RecordNotFound
+      false
+    end
+
+    def update_or_create
+      model.save
+    end
+
     class << self
       #
       # Load rule from YAML string

data/lib/mihari/service.rb

@@ -9,8 +9,18 @@ module Mihari
       raise NotImplementedError, "You must implement #{self.class}##{__method__}"
     end
 
-    def result
-      Try[StandardError] { call }.to_result
+    def result(...)
+      Try[StandardError] { call(...) }.to_result
+    end
+
+    class << self
+      def call(...)
+        new.call(...)
+      end
+
+      def result(...)
+        new.result(...)
+      end
     end
   end
 end

data/lib/mihari/services/alert_builder.rb

@@ -9,23 +9,90 @@ require "yaml"
 module Mihari
   module Services
     #
-    # Alert builder
+    # Alert proxy
     #
-    class AlertBuilder < Service
-      # @return [String]
-      attr_reader :path
+    class AlertProxy
+      # @return [Hash]
+      attr_reader :data
+
+      # @return [Array, nil]
+      attr_reader :errors
 
       #
       # Initialize
       #
-      # @param [String] path
+      # @param [Hash] data
       #
-      def initialize(path)
+      def initialize(**data)
         super()
 
-        @path = path
+        @data = data.deep_symbolize_keys
+        @errors = nil
+
+        validate!
+      end
+
+      #
+      # @return [Boolean]
+      #
+      def errors?
+        return false if @errors.nil?
+
+        !@errors.empty?
+      end
+
+      def validate!
+        contract = Schemas::AlertContract.new
+        result = contract.call(data)
+
+        @data = result.to_h
+        @errors = result.errors
+
+        raise ValidationError.new("Validation failed", errors) if errors?
+      end
+
+      def [](key)
+        data key.to_sym
+      end
+
+      #
+      # @return [String]
+      #
+      def rule_id
+        @rule_id ||= data[:rule_id]
+      end
+
+      #
+      # @return [Array<Mihari::Models::Artifact>]
+      #
+      def artifacts
+        @artifacts ||= data[:artifacts].map do |data|
+          artifact = Models::Artifact.new(data: data)
+          artifact.rule_id = rule_id
+          artifact
+        end.uniq(&:data).select(&:valid?)
+      end
+
+      #
+      # @return [Mihari::Rule]
+      #
+      def rule
+        @rule ||= [].tap do |out|
+          data = Mihari::Models::Rule.find(rule_id).data
+          out << Rule.new(**data)
+        end.first
       end
+    end
+
+    #
+    # Alert builder
+    #
+    class AlertBuilder < Service
+      # @return [String]
+      attr_reader :path
 
+      #
+      # @param [String] path
       #
       # @return [Hash]
       #
@@ -38,7 +105,13 @@ module Mihari
         )
       end
 
-      def call
+      #
+      # @param [String] path
+      #
+      # @return [Mihari::AlertProxy]
+      #
+      def call(path)
+        @path = path
         AlertProxy.new(**data)
       end
     end

data/lib/mihari/services/alert_runner.rb

@@ -6,19 +6,12 @@ module Mihari
     # Alert runner
     #
     class AlertRunner < Service
-      # @return [Mihari::Services::AlertProxy]
-      attr_reader :alert
-
-      def initialize(alert)
-        super()
-
-        @alert = alert
-      end
-
+      #
+      # @param [Mihari::Services::AlertProxy] alert
       #
       # @return [Mihari::Models::Alert]
       #
-      def call
+      def call(alert)
         emitter = Emitters::Database.new(rule: alert.rule)
         emitter.call alert.artifacts
       end

data/lib/mihari/services/rule_builder.rb

@@ -14,17 +14,8 @@ module Mihari
       # @return [String]
       attr_reader :path_or_id
 
-      #
-      # Initialize
       #
       # @param [String] path_or_id
-      #
-      def initialize(path_or_id)
-        super()
-
-        @path_or_id = path_or_id
-      end
-
       #
       # @return [Hash]
       #
@@ -42,7 +33,14 @@ module Mihari
         )
       end
 
-      def call
+      #
+      # @param [String] path_or_id
+      #
+      # @return [Mihari::Rule]
+      #
+      def call(path_or_id)
+        @path_or_id = path_or_id
+
         Rule.new(**data)
       end
     end

data/lib/mihari/services/rule_runner.rb

@@ -6,35 +6,12 @@ module Mihari
     # Rule runner
     #
     class RuleRunner < Service
-      include Dry::Monads[:result, :try]
-
-      # @return [Mihari::Rule]
-      attr_reader :rule
-
-      def initialize(rule)
-        super()
-
-        @rule = rule
-      end
-
       #
-      # @return [Boolean]
-      #
-      def diff?
-        model = Mihari::Models::Rule.find(rule.id)
-        model.data != rule.data.deep_stringify_keys
-      rescue ActiveRecord::RecordNotFound
-        false
-      end
-
-      def update_or_create
-        rule.model.save
-      end
-
+      # @params [Mihari::Rule]
       #
       # @return [Mihari::Models::Alert, nil]
       #
-      def call
+      def call(rule)
         rule.call
       end
     end

data/lib/mihari/structs/binaryedge.rb

@@ -9,6 +9,9 @@ module Mihari
         attribute :ip, Types::String
 
         class << self
+          #
+          # @param [Hash] d
+          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -24,6 +27,9 @@ module Mihari
         attribute :target, Target
 
         class << self
+          #
+          # @param [Hash] d
+          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -58,6 +64,9 @@ module Mihari
         end
 
         class << self
+          #
+          # @param [Hash] d
+          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(

data/lib/mihari/structs/censys.rb

@@ -21,8 +21,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [AutonomousSystem]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -59,8 +57,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Location]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -87,8 +83,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Service]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -143,8 +137,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Hit]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -171,8 +163,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Links]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -211,8 +201,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Result]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -242,8 +230,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Response]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(

data/lib/mihari/structs/fofa.rb

@@ -27,6 +27,9 @@ module Mihari
         attribute? :results, Types.Array(Types.Array(Types::String)).optional
 
         class << self
+          #
+          # @param [Hash] d
+          #
           def from_dynamic!(d)
             new(
               error: d.fetch("error"),

data/lib/mihari/structs/google_public_dns.rb

@@ -28,8 +28,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Answer]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             resource_type = INT_TYPE_TO_TYPE[d.fetch("type")]
@@ -51,8 +49,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Response]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(

data/lib/mihari/structs/greynoise.rb

@@ -39,8 +39,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Metadata]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -81,8 +79,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Datum]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -130,8 +126,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Response]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(

data/lib/mihari/structs/hunterhow.rb

@@ -27,8 +27,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [ListItem]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -60,8 +58,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [DataClass]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -89,8 +85,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Response]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(

data/lib/mihari/structs/ipinfo.rb

@@ -30,8 +30,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Response]
-          #
           def from_dynamic!(d)
             d = d.deep_stringify_keys
             d = Types::Hash[d]

data/lib/mihari/structs/onyphe.rb

@@ -58,8 +58,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Result]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -113,8 +111,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Response]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(

data/lib/mihari/structs/shodan.rb

@@ -221,8 +221,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [InternetDBResponse]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(

data/lib/mihari/structs/urlscan.rb

@@ -20,8 +20,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Page]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -62,8 +60,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Result]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -96,8 +92,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Response]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(

data/lib/mihari/structs/virustotal_intelligence.rb

@@ -12,8 +12,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [ContextAttributes]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(url: d["url"])
@@ -65,8 +63,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Datum]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
 
@@ -94,8 +90,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Meta]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(
@@ -125,8 +119,6 @@ module Mihari
           #
           # @param [Hash] d
           #
-          # @return [Response]
-          #
           def from_dynamic!(d)
             d = Types::Hash[d]
             new(

data/lib/mihari/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Mihari
-  VERSION = "5.7.0"
+  VERSION = "5.7.2"
 end

data/lib/mihari/web/app.rb

@@ -22,6 +22,12 @@ module Mihari
     # Rack + Grape based web app
     #
     class App
+      # @return [Array<String>]
+      attr_reader :filenames
+
+      # @return [Rack::Static]
+      attr_reader :rack_static
+
       def initialize
         @filenames = ["", ".html", "index.html", "/index.html"]
         @rack_static = Rack::Static.new(
@@ -31,6 +37,20 @@ module Mihari
         )
       end
 
+      def call(env)
+        status, headers, body = API.call(env)
+        return [status, headers, body] unless headers["X-Cascade"] == "pass"
+
+        # Check if the App wants us to pass the response along to others
+        request_path = env["PATH_INFO"]
+        filenames.each do |path|
+          static_status, static_headers, static_body = rack_static.call(env.merge("PATH_INFO" => request_path + path))
+          return [static_status, static_headers, static_body] if static_status != 404
+        end
+
+        [status, headers, body]
+      end
+
       class << self
         def instance
           @instance ||= Rack::Builder.new do
@@ -71,23 +91,6 @@ module Mihari
           end
         end
       end
-
-      def call(env)
-        # api
-        api_response = API.call(env)
-
-        # Check if the App wants us to pass the response along to others
-        if api_response[1]["X-Cascade"] == "pass"
-          # static files
-          request_path = env["PATH_INFO"]
-          @filenames.each do |path|
-            response = @rack_static.call(env.merge("PATH_INFO" => request_path + path))
-            return response if response[0] != 404
-          end
-        end
-
-        api_response
-      end
     end
   end
 end