From a228e2505dbb8989048773d75a4b520c232e99fb Mon Sep 17 00:00:00 2001 From: chrisr3d Date: Thu, 17 Oct 2019 10:42:34 +0200 Subject: [PATCH 1/2] fix: Avoiding empty values + Fixed empty types error + Fixed filename KeyError --- misp_modules/modules/expansion/threatminer.py | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/misp_modules/modules/expansion/threatminer.py b/misp_modules/modules/expansion/threatminer.py index 292d00b..d695271 100755 --- a/misp_modules/modules/expansion/threatminer.py +++ b/misp_modules/modules/expansion/threatminer.py @@ -26,10 +26,11 @@ class ThreatMiner(): def parsed_results(self): to_return = [] for key, values in self.results.items(): - input_value, comment = key[:2] - types = [k for k in key[2:]] - to_return.append({'types': types, 'values': list(values), - 'comment': self.comment.format(input_value, comment)}) + if values: + input_value, comment = key[:2] + types = [k for k in key[2:]] + to_return.append({'types': types, 'values': list(values), + 'comment': self.comment.format(input_value, comment)}) return to_return def parse_query(self, request): @@ -82,7 +83,7 @@ class ThreatMiner(): self.results[(q, comment, 'domain')].update({result for result in results if isinstance(result, str)}) def _add_filename(self, results, q, comment): - self.results[(q, comment, 'filename')].update({result['filename'] for result in results if result.get('file_name')}) + self.results[(q, comment, 'filename')].update({result['file_name'] for result in results if result.get('file_name')}) def _add_hash(self, results, q, comment): self.results[(q, comment, 'sha256')].update({result for result in results if isinstance(result, str)}) @@ -118,7 +119,7 @@ class ThreatMiner(): self.results[(q, comment, 'whois-registrant-email')].update({email for em_type, email in emails.items() if em_type == 'registrant' and email}) def _add_x509(self, results, q, comment): - self.results[(q, 'x509-fingerprint-sha1')].update({result for result in results if isinstance(result, str)}) + self.results[(q, comment, 'x509-fingerprint-sha1')].update({result for result in results if isinstance(result, str)}) def handler(q=False): From d740abe74ba0b150a2f2b4412cbf3cdddf18f8ca Mon Sep 17 00:00:00 2001 From: chrisr3d Date: Thu, 17 Oct 2019 10:45:51 +0200 Subject: [PATCH 2/2] fix: Making pep8 happy --- misp_modules/modules/expansion/threatminer.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/misp_modules/modules/expansion/threatminer.py b/misp_modules/modules/expansion/threatminer.py index d695271..1dd2bd8 100755 --- a/misp_modules/modules/expansion/threatminer.py +++ b/misp_modules/modules/expansion/threatminer.py @@ -13,14 +13,15 @@ moduleinfo = {'version': '1', 'author': 'KX499', 'description': 'Get information from ThreatMiner', 'module-type': ['expansion']} + class ThreatMiner(): def __init__(self): self.results = defaultdict(set) self.comment = '{}: Threatminer - {}' self.types_mapping = {'domain': '_get_domain', 'hostname': '_get_domain', - 'ip-dst': '_get_ip', 'ip-src': '_get_ip', - 'md5': '_get_hash', 'sha1': '_get_hash', - 'sha256': '_get_hash', 'sha512': '_get_hash'} + 'ip-dst': '_get_ip', 'ip-src': '_get_ip', + 'md5': '_get_hash', 'sha1': '_get_hash', + 'sha256': '_get_hash', 'sha512': '_get_hash'} @property def parsed_results(self):