scopes_extractor 0.6.0 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 53708b2ee96a050695c28add808c5b8bf8cdfb7e6497aa5d35f0aff99fe7cca3
-  data.tar.gz: 1c598a6d8de2708c3b8431e84ac8456dde7f9e4f468d69e2c29e9e36ea26b4f0
+  metadata.gz: edd3e5dc9cc8ae3d8cf7ca78b46f59ef66efda9d24c295b7f9577ce34752a681
+  data.tar.gz: 2e1762a5bbb34bb239249e7288ad6e8efdc29d4bac8748d968f8d7620c706d8c
 SHA512:
-  metadata.gz: 74947fc21e47e8373e92598b38f856241f837051f86d9de70cd5a857ee12daf6c1ecc111d69ff3652ca1a459bd66c69deb3989ff7d23f35ff65580075a861c16
-  data.tar.gz: e34117a9518c303601948111c24beafb2c3f4b594891c11eef01240a19bcc76ee94e4ce0670da6323db796553d8c85a0dfdce3bbf6fcd6ae42d17664b88308a6
+  metadata.gz: d8777cfd7ecce621fa075c32af17e48ef38674dc24dfef40ee97bb297aa2956dece20aec4c5dccbafcf79f37d19457c9d78ab5aa40ee47477f68806c9e8a93e7
+  data.tar.gz: '0216516396422fad634543f57fd61c250edf1abe6975ffb2d1187ac9659e9cdc5bfd1772013865a1c0cf98768292d2674edd1ee44dd5d3e0a48c60ff0bd12617'

data/lib/scopes_extractor/platforms/bugcrowd/scopes.rb

@@ -37,7 +37,8 @@ class Bugcrowd
         next if exclusions.any? { |exclusion| endpoint.include?(exclusion) } || !endpoint.include?('.')
         next if endpoint.include?('*') && !endpoint.start_with?('*.')
 
-        scopes_normalized << endpoint
+        endpoint.sub!(%r{/$}, '')
+        scopes_normalized << endpoint.sub('/*', '')
       end
 
       scopes_normalized

data/lib/scopes_extractor/platforms/hackerone/programs.rb

@@ -14,7 +14,7 @@ class Hackerone
         next if options[:skip_vdp] && !program['attributes']['offers_bounties']
 
         results[program['attributes']['name']] = program_info(program)
-        results[program['attributes']['name']]['scopes'] = Scopes.sync(program_info(program))
+        results[program['attributes']['name']]['scopes'] = Scopes.sync(program_info(program), options)
       end
 
       sync(results, options, page_id + 1) if programs_infos[:next_page]

data/lib/scopes_extractor/platforms/hackerone/scopes.rb

@@ -3,24 +3,26 @@
 class Hackerone
   # Hackerone Sync Programs
   class Scopes
-    def self.sync(program)
+    def self.sync(program, options)
       scopes = {}
       response = HttpClient.get("https://api.hackerone.com/v1/hackers/programs/#{program[:slug]}")
       return scopes unless response&.code == 200
 
       in_scopes = JSON.parse(response.body)['relationships']['structured_scopes']['data']
-      scopes['in'] = parse_scopes(in_scopes)
+      scopes['in'] = parse_scopes(in_scopes, options)
 
       scopes['out'] = {} # TODO
 
       scopes
     end
 
-    def self.parse_scopes(scopes)
+    def self.parse_scopes(scopes, options)
       scopes_normalized = []
 
       scopes.each do |scope|
-        next unless scope['attributes']['asset_type'] == 'URL'
+        next if scope['attributes']['eligible_for_submission'] == false ||
+          (scope['attributes']['eligible_for_bounty'] == false && options[:skip_vdp])
+        next unless %w[URL WILDCARD].any?(scope['attributes']['asset_type'])
 
         endpoint = scope['attributes']['asset_identifier']
         normalized = normalized(endpoint)
@@ -28,8 +30,9 @@ class Hackerone
         normalized.each do |asset|
           next unless asset.include?('.')
           next if asset.include?('*') && !asset.start_with?('*.')
+          next unless asset.match?(/\w\./)
 
-          scopes_normalized << asset
+          scopes_normalized << asset.sub('/*', '')
         end
       end
 
@@ -42,9 +45,9 @@ class Hackerone
       normalized = []
 
       if endpoint.include?(',')
-        endpoint.split(',').each { |asset| normalized << asset }
+        endpoint.split(',').each { |asset| normalized << asset.sub('/*', '') }
       else
-        normalized << endpoint
+        normalized << endpoint.sub('/*', '')
       end
 
       normalized

data/lib/scopes_extractor/platforms/yeswehack/scopes.rb

@@ -28,7 +28,7 @@ class YesWeHack
           next unless asset.include?('.')
           next if asset.include?('*') && !asset.start_with?('*.')
 
-          scopes_normalized << asset
+          scopes_normalized << asset.sub('/*', '')
         end
       end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: scopes_extractor
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.7.0
 platform: ruby
 authors:
 - Joshua MARTINELLE
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-05-23 00:00:00.000000000 Z
+date: 2023-05-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: colorize