scopes_extractor 0.5.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f4d182543a95c5350e15e48ac31e9294144bbfac8b8ab7b46c2fe473e0e29853
-  data.tar.gz: a7b9dd659a243d2c9714a807824d11631040ee4e199756b79d99f5dbf5f5c7e5
+  metadata.gz: edd3e5dc9cc8ae3d8cf7ca78b46f59ef66efda9d24c295b7f9577ce34752a681
+  data.tar.gz: 2e1762a5bbb34bb239249e7288ad6e8efdc29d4bac8748d968f8d7620c706d8c
 SHA512:
-  metadata.gz: 3b7dce096f56b17a31ad146b8f2b6b0c0f11643fa703f77410b4b0f1de2cf2ef9dc0557849144e9abef3628216032a909d5d65bb5d385a2a382d9eb6c718c5b6
-  data.tar.gz: 44c364cd7de7a23903e380dc1d6d367a55ac81143054bae1688b0eaf2de80efb0d59bcf5464fdbdf223c298ab24821f65ceedb11cb26fbfbd8a0f2e69e5b4e84
+  metadata.gz: d8777cfd7ecce621fa075c32af17e48ef38674dc24dfef40ee97bb297aa2956dece20aec4c5dccbafcf79f37d19457c9d78ab5aa40ee47477f68806c9e8a93e7
+  data.tar.gz: '0216516396422fad634543f57fd61c250edf1abe6975ffb2d1187ac9659e9cdc5bfd1772013865a1c0cf98768292d2674edd1ee44dd5d3e0a48c60ff0bd12617'

data/lib/scopes_extractor/platforms/bugcrowd/scopes.rb

@@ -33,10 +33,12 @@ class Bugcrowd
       scopes.each do |scope|
         next unless scope['category'] == 'website' || scope['category'] == 'api'
 
-        endpoint = scope['name']
+        endpoint = scope['name'].split.first
         next if exclusions.any? { |exclusion| endpoint.include?(exclusion) } || !endpoint.include?('.')
+        next if endpoint.include?('*') && !endpoint.start_with?('*.')
 
-        scopes_normalized << endpoint
+        endpoint.sub!(%r{/$}, '')
+        scopes_normalized << endpoint.sub('/*', '')
       end
 
       scopes_normalized

data/lib/scopes_extractor/platforms/hackerone/programs.rb

@@ -14,7 +14,7 @@ class Hackerone
         next if options[:skip_vdp] && !program['attributes']['offers_bounties']
 
         results[program['attributes']['name']] = program_info(program)
-        results[program['attributes']['name']]['scopes'] = Scopes.sync(program_info(program))
+        results[program['attributes']['name']]['scopes'] = Scopes.sync(program_info(program), options)
       end
 
       sync(results, options, page_id + 1) if programs_infos[:next_page]

data/lib/scopes_extractor/platforms/hackerone/scopes.rb

@@ -3,30 +3,36 @@
 class Hackerone
   # Hackerone Sync Programs
   class Scopes
-    def self.sync(program)
+    def self.sync(program, options)
       scopes = {}
       response = HttpClient.get("https://api.hackerone.com/v1/hackers/programs/#{program[:slug]}")
       return scopes unless response&.code == 200
 
       in_scopes = JSON.parse(response.body)['relationships']['structured_scopes']['data']
-      scopes['in'] = parse_scopes(in_scopes)
+      scopes['in'] = parse_scopes(in_scopes, options)
 
       scopes['out'] = {} # TODO
 
       scopes
     end
 
-    def self.parse_scopes(scopes)
+    def self.parse_scopes(scopes, options)
       scopes_normalized = []
 
       scopes.each do |scope|
-        next unless scope['attributes']['asset_type'] == 'URL'
+        next if scope['attributes']['eligible_for_submission'] == false ||
+          (scope['attributes']['eligible_for_bounty'] == false && options[:skip_vdp])
+        next unless %w[URL WILDCARD].any?(scope['attributes']['asset_type'])
 
         endpoint = scope['attributes']['asset_identifier']
         normalized = normalized(endpoint)
 
         normalized.each do |asset|
-          scopes_normalized << asset
+          next unless asset.include?('.')
+          next if asset.include?('*') && !asset.start_with?('*.')
+          next unless asset.match?(/\w\./)
+
+          scopes_normalized << asset.sub('/*', '')
         end
       end
 
@@ -39,9 +45,9 @@ class Hackerone
       normalized = []
 
       if endpoint.include?(',')
-        endpoint.split(',').each { |asset| normalized << asset }
+        endpoint.split(',').each { |asset| normalized << asset.sub('/*', '') }
       else
-        normalized << endpoint
+        normalized << endpoint.sub('/*', '')
       end
 
       normalized

data/lib/scopes_extractor/platforms/yeswehack/scopes.rb

@@ -26,8 +26,9 @@ class YesWeHack
         normalized = normalize(infos['scope'])
         normalized.each do |asset|
           next unless asset.include?('.')
+          next if asset.include?('*') && !asset.start_with?('*.')
 
-          scopes_normalized << asset
+          scopes_normalized << asset.sub('/*', '')
         end
       end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: scopes_extractor
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.7.0
 platform: ruby
 authors:
 - Joshua MARTINELLE
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-05-23 00:00:00.000000000 Z
+date: 2023-05-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: colorize