# Path: mwscan/settings.py
# CACHEDIR = os.path.expanduser('~/.cache/mwscan')
# LAST_RUN_FILE = os.path.join(CACHEDIR, 'last_run')
# DEFAULT_EXCLUDEFILE = os.path.expanduser('~/.config/mwscan/excludes')
# CODE_EXT = ('php', 'phtml', 'js', 'jsx', 'html', 'php3', 'php4', 'php5', 'php7', 'sh', 'ini')


import os
import re
import json
import logging
import hashlib
import requests
import yara
import time
from requests.exceptions import RequestException
from mwscan import settings

class RulesProvider:
    rules_url = None
    whitelist_url = None

    def __init__(self, **kwargs):
        logging.info("Using {0} rules.".format(self.__class__.__name__))
        self._args = kwargs.get('args')

    def find_whitelist_in_rawrules(self, rawrules):
        # Find whitelist hashes from comments, because yara whitelist
        # hashing is too slow. See
        # https://github.com/VirusTotal/yara/issues/592

        m = re.search(
            '/\*[^*]*WHITELIST = (\{.*?\})\s*\*/', rawrules, flags=re.DOTALL)
        return set(json.loads(m.group(1)) if m else [])

    def get_rules(self):
        rawrules = self._recursive_fetch(self.rules_url)
        try:
            if type(rawrules) is unicode:
                return rawrules.encode('ascii', 'ignore')
        except NameError:
            pass # py3

        return rawrules


    def get_whitelist(self):

# Path: mwscan/settings.py
# CACHEDIR = os.path.expanduser('~/.cache/mwscan')
# LAST_RUN_FILE = os.path.join(CACHEDIR, 'last_run')
# DEFAULT_EXCLUDEFILE = os.path.expanduser('~/.config/mwscan/excludes')
# CODE_EXT = ('php', 'phtml', 'js', 'jsx', 'html', 'php3', 'php4', 'php5', 'php7', 'sh', 'ini')


# Path: mwscan/ruleset.py
import os
import re
import json
import logging
import hashlib
import requests
import yara
import time
from requests.exceptions import RequestException
from mwscan import settings


class RulesProvider:
    rules_url = None
    whitelist_url = None

    def __init__(self, **kwargs):
        logging.info("Using {0} rules.".format(self.__class__.__name__))
        self._args = kwargs.get('args')

    def find_whitelist_in_rawrules(self, rawrules):
        # Find whitelist hashes from comments, because yara whitelist
        # hashing is too slow. See
        # https://github.com/VirusTotal/yara/issues/592

        m = re.search(
            '/\*[^*]*WHITELIST = (\{.*?\})\s*\*/', rawrules, flags=re.DOTALL)
        return set(json.loads(m.group(1)) if m else [])

    def get_rules(self):
        rawrules = self._recursive_fetch(self.rules_url)
        try:
            if type(rawrules) is unicode:
                return rawrules.encode('ascii', 'ignore')
        except NameError:
            pass # py3

        return rawrules


    def get_whitelist(self):

        if not self.whitelist_url: