ail-framework/var/www/modules/hunter/Flask_hunter.py

#!/usr/bin/env python3
# -*-coding:UTF-8 -*

'''
    Flask functions and routes for tracked items
'''
import os
import sys
import json
import flask
from flask import Flask, render_template, jsonify, request, Blueprint, url_for, redirect, Response, escape

from Role_Manager import login_admin, login_analyst, login_read_only
from flask_login import login_required, current_user

sys.path.append(os.environ['AIL_BIN'])
##################################
# Import Project packages
##################################
from lib.objects import ail_objects
from lib import item_basic
from lib import Tracker
from lib import Tag
from packages import Date


# ============ VARIABLES ============
import Flask_config

app = Flask_config.app
baseUrl = Flask_config.baseUrl
bootstrap_label = Flask_config.bootstrap_label

hunter = Blueprint('hunter', __name__, template_folder='templates')

# ============ FUNCTIONS ============

def create_json_response(data, status_code):
    return Response(json.dumps(data, indent=2, sort_keys=True), mimetype='application/json'), status_code

# ============ ROUTES ============

@hunter.route("/tracker/edit", methods=['GET', 'POST'])
@login_required
@login_analyst
def edit_tracked_menu():
    user_id = current_user.get_id()
    tracker_uuid = request.args.get('uuid', None)

    res = Tracker.api_is_allowed_to_edit_tracker(tracker_uuid, user_id) # check if is author or admin
    if res[1] != 200: # invalid access
        return Response(json.dumps(res[0], indent=2, sort_keys=True), mimetype='application/json'), res[1]

    tracker = Tracker.Tracker(tracker_uuid)
    dict_tracker = tracker.get_meta(options={'description', 'level', 'mails', 'sources', 'tags', 'user', 'webhook'})
    dict_tracker['tags'] = ' '.join(dict_tracker['tags'])
    dict_tracker['mails'] = ' '.join(dict_tracker['mails'])

    if dict_tracker['type'] == 'set':
        dict_tracker['tracker'], dict_tracker['nb_words'] = dict_tracker['tracker'].split(';')
        dict_tracker['tracker'] = dict_tracker['tracker'].replace(',', ' ')
    elif dict_tracker['type'] == 'yara': #is_valid_default_yara_rule
        if Tracker.is_default_yara_rule(dict_tracker['tracker']):
            dict_tracker['yara_file'] = dict_tracker['tracker'].split('/')
            dict_tracker['yara_file'] = dict_tracker['yara_file'][-2] + '/' + dict_tracker['yara_file'][-1]
            dict_tracker['content'] = None
        else:
            dict_tracker['yara_file'] = None
            dict_tracker['content'] = Tracker.get_yara_rule_content(dict_tracker['tracker'])

    return render_template("edit_tracker.html", dict_tracker=dict_tracker,
                                all_sources=item_basic.get_all_items_sources(r_list=True),
                                all_yara_files=Tracker.get_all_default_yara_files())

    ## TO EDIT
    # word
    # set of word + nb words
    # regex
    # yara custom
    # yara default ???? => allow edit ?

    #### EDIT SHow Trackers ??????????????????????????????????????????????????

@hunter.route("/tracker/show_tracker")
@login_required
@login_read_only
def show_tracker():
    user_id = current_user.get_id()
    tracker_uuid = request.args.get('uuid', None)
    res = Tracker.api_is_allowed_to_edit_tracker(tracker_uuid, user_id)
    if res[1] != 200: # invalid access
        return Response(json.dumps(res[0], indent=2, sort_keys=True), mimetype='application/json'), res[1]

    date_from = request.args.get('date_from')
    date_to = request.args.get('date_to')

    if date_from:
        date_from = date_from.replace('-', '')
    if date_to:
        date_to = date_to.replace('-', '')

    tracker = Tracker.Tracker(tracker_uuid)
    meta = tracker.get_meta(options={'description', 'level', 'mails', 'filters', 'sparkline', 'tags',
                                     'user', 'webhook'})

    if meta['type'] == 'yara':
        yara_rule_content = Tracker.get_yara_rule_content(meta['tracked'])
    else:
        yara_rule_content = None
   
    if meta['type'] == 'typosquatting':
        typo_squatting = Tracker.get_tracked_typosquatting_domains(meta['tracked'])
        sorted(typo_squatting)
    else:
        typo_squatting = set()

    if date_from:
        date_from, date_to = Date.sanitise_daterange(meta['first_seen'], meta['last_seen'])
        objs = tracker.get_objs_by_daterange(date_from, date_to)
        meta['objs'] = ail_objects.get_objects_meta(objs, flask_context=True)
    else:
        date_from = ''
        date_to = ''
        meta['objs'] = []

    meta['date_from'] = date_from
    meta['date_to'] = date_to
    print(meta['filters'])
    meta['item_sources'] = sorted(meta['filters'].get('item', {}).get('sources', []))

    return render_template("showTracker.html", tracker_metadata=meta,
                           yara_rule_content=yara_rule_content,
                           typo_squatting=typo_squatting,
                           bootstrap_label=bootstrap_label)

@hunter.route("/tracker/update_tracker_description", methods=['POST'])
@login_required
@login_analyst
def update_tracker_description():
    user_id = current_user.get_id()
    term_uuid = request.form.get('uuid')
    res = Tracker.api_is_allowed_to_edit_tracker(term_uuid, user_id)
    if res[1] != 200: # invalid access
        return Response(json.dumps(res[0], indent=2, sort_keys=True), mimetype='application/json'), res[1]
    description = escape( str(request.form.get('description', '')) )
    Term.replace_tracker_description(term_uuid, description)
    return redirect(url_for('hunter.show_tracker', uuid=term_uuid))

@hunter.route("/tracker/update_tracker_tags", methods=['POST'])
@login_required
@login_analyst
def update_tracker_tags():
    user_id = current_user.get_id()
    term_uuid = request.form.get('uuid')
    res = Tracker.api_is_allowed_to_edit_tracker(term_uuid, user_id)
    if res[1] != 200: # invalid access
        return Response(json.dumps(res[0], indent=2, sort_keys=True), mimetype='application/json'), res[1]
    tags = request.form.get('tags')
    if tags:
        tags = tags.split()
    else:
        tags = []
    Term.replace_tracked_term_tags(term_uuid, tags)
    return redirect(url_for('hunter.show_tracker', uuid=term_uuid))

@hunter.route("/tracker/update_tracker_mails", methods=['POST'])
@login_required
@login_analyst
def update_tracker_mails():
    user_id = current_user.get_id()
    term_uuid = request.form.get('uuid')
    res = Tracker.api_is_allowed_to_edit_tracker(term_uuid, user_id)
    if res[1] != 200: # invalid access
        return Response(json.dumps(res[0], indent=2, sort_keys=True), mimetype='application/json'), res[1]
    mails = request.form.get('mails')
    if mails:
        mails = mails.split()
    else:
        mails = []
    res = Term.replace_tracked_term_mails(term_uuid, mails)
    if res: # invalid mail
        return Response(json.dumps(res[0], indent=2, sort_keys=True), mimetype='application/json'), res[1]
    return redirect(url_for('hunter.show_tracker', uuid=term_uuid))

@hunter.route("/tracker/get_json_tracker_stats", methods=['GET'])
@login_required
@login_read_only
def get_json_tracker_stats():
    user_id = current_user.get_id()
    tracker_uuid = request.args.get('uuid')
    res = Tracker.api_check_tracker_acl(tracker_uuid, user_id)
    if res:
        return create_json_response(res[0], res[1])

    date_from = request.args.get('date_from')
    date_to = request.args.get('date_to')

    if date_from:
        date_from = date_from.replace('-', '')
    if date_to:
        date_to = date_to.replace('-', '')
    if date_from and date_to:
        res = Tracker.get_trackers_graph_by_day([tracker_uuid], date_from=date_from, date_to=date_to)
    else:
        res = Tracker.get_trackers_graph_by_day([tracker_uuid])
    return jsonify(res)

@hunter.route("/tracker/yara/default_rule/content", methods=['GET'])
@login_required
@login_read_only
def get_default_yara_rule_content():
    default_yara_rule = request.args.get('rule_name')
    res = Tracker.api_get_default_rule_content(default_yara_rule)
    return Response(json.dumps(res[0], indent=2, sort_keys=True), mimetype='application/json'), res[1]


# ========= REGISTRATION =========
app.register_blueprint(hunter, url_prefix=baseUrl)