<commit_before>"""
Malc0de RSS bot.

Maintainer: <NAME> <<EMAIL>>
"""
import socket
from abusehelper.core import bot, events
from abusehelper.contrib.rssbot.rssbot import RSSBot


class Malc0deBot(RSSBot):
    feeds = bot.ListParam(default=["http://malc0de.com/rss/"])
    resolve_ip = bot.BoolParam()

    def is_ip(self, string):
        for addr_type in (socket.AF_INET, socket.AF_INET6):
            try:
                socket.inet_pton(addr_type, string)
            except (ValueError, socket.error):
                pass
            else:
                return True
        return False

    def create_event(self, **keys):
        description = keys.get("description", None)
        if description is None:
            return None

        event = events.Event()
        event.add("feed", "malc0de")
        event.add("type", "malware")

        link = keys.get("link", None)
        if link:
            event.add("source url", link)

        for part in description.split(","):
            pair = part.split(":", 1)
            if len(pair) < 2:
                continue

            key = pair[0].strip()
            value = pair[1].strip()
            if not key or not value:
                continue

            if key in ["URL", "ASN", "MD5"]:
                if key == "URL":
                    value = "hxxp://" + value
                event.add(key.lower(), value)
            elif key == "IP Address":
                if not self.resolve_ip:
                    event.add("ip", value)

        host = keys.get("title", None)
        if not self.is_ip(host):
            event.add("host", host)

        return event

if __name__ == "__main__":
    Malc0deBot.from_command_line().run()
<commit_msg>abusehelper.contrib.malc0de.malc0debot: Removed ash key, since we rely on cymru asn.<commit_after>"""
Malc0de RSS bot.

Maintainer: <NAME> <<EMAIL>>
"""
import socket
from abusehelper.core import bot, events
from abusehelper.contrib.rssbot.rssbot import RSSBot


class Malc0deBot(RSSBot):
    feeds = bot.ListParam(default=["http://malc0de.com/rss/"])
    resolve_ip = bot.BoolParam()

    def is_ip(self, string):
        for addr_type in (socket.AF_INET, socket.AF_INET6):
            try:
                socket.inet_pton(addr_type, string)
            except (ValueError, socket.error):
                pass
            else:
                return True
        return False

    def create_event(self, **keys):
        description = keys.get("description", None)
        if description is None:
            return None

        event = events.Event()
        event.add("feed", "malc0de")
        event.add("type", "malware")

        link = keys.get("link", None)
        if link:
            event.add("source url", link)

        for part in description.split(","):
            pair = part.split(":", 1)
            if len(pair) < 2:
                continue

            key = pair[0].strip()
            value = pair[1].strip()
            if not key or not value:
                continue

            if key in ["URL", "MD5"]:
                if key == "URL":
                    value = "hxxp://" + value
                event.add(key.lower(), value)
            elif key == "IP Address":
                if not self.resolve_ip:
                    event.add("ip", value)

        host = keys.get("title", None)
        if not self.is_ip(host):
            event.add("host", host)

        return event

if __name__ == "__main__":
    Malc0deBot.from_command_line().run()

{'fraction_non_alphanumeric': 0.12414383561643835, 'fraction_numerical': 0.00684931506849315, 'mean_word_length': 1.6982294072363358, 'pattern_counts': {'":': 8, '<': 11, '<?xml version=': 0, '>': 9, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6258673', 'n_tokens_mistral': 1063, 'n_tokens_neox': 1020, 'n_words': 266}