Repository: smicallef/spiderfoot
File: modules/sfp_threatjammer.py (Python)

Code before:

        self.results[eventData] = True

        if eventName.startswith("AFFILIATE") and not self.opts['checkaffiliates']:
            return

        if eventName in ['IP_ADDRESS', 'IPV6_ADDRESS']:
            blacklist_type = "BLACKLISTED_IPADDR"
            malicious_type = 'MALICIOUS_IPADDR'
        elif eventName in ['AFFILIATE_IPADDR', 'AFFILIATE_IPV6_ADDRESS']:
            blacklist_type = "BLACKLISTED_AFFILIATE_IPADDR"
            malicious_type = 'MALICIOUS_AFFILIATE_IPADDR'
        else:
            self.debug(f"Unexpected event type {eventName}, skipping")
            return

        self.debug(f"Checking maliciousness of IP address {eventData} with ThreatJammer.com")

        ip_info = self.queryIp(eventData)

        if ip_info is None:
            self.sf.error(f"Error processing JSON response for {eventData} from ThreatJammer.com")
            return

        risk_score = int(ip_info["score"])
        risk = ip_info["risk"]

        if risk_score < self.opts["risk_score_min"]:
            self.debug(f"Skipping {eventData} for ThreatJammer.com, risk score below minimum threshold.")
            return

        url = "https://threatjammer.com/info/"
        detail = f"""Risk score: {risk_score} ({risk})\n<SFURL>{url}{eventData}</SFURL>"""

        self.info(f"Malicious IP address {eventData} found in any Threat Jammer lists")

        evt = SpiderFootEvent(
            malicious_type,
            f"Threat Jammer - {detail}",
            self.__name__,
            event
        )
        self.notifyListeners(evt)

        evt = SpiderFootEvent(
            blacklist_type,
            f"Threat Jammer  - {detail}",
            self.__name__,
            event
        )
        self.notifyListeners(evt)

Review comment (bug):
These should be checked for validity.

Something like this (depending on how zero is handled).

```suggestion
        risk_score = ip_info.get('score')
        if not risk_score:
            # this might been the address is not malicious,
            # or might mean that the response was not in the expected format.
            # validate appropriately.
            # maybe print a debug message
            return
        risk_score = int(risk_score)

        risk = ip_info('risk')
        if not risk:
            # how is there no risk if there is a risk score?
            # halt and catch fire
            return
```

Code after:
        eventName = event.eventType
        srcModuleName = event.module
        eventData = event.data

        self.debug(f"Received event, {eventName}, from {srcModuleName}")

        if self.opts["api_key"] == "":
            self.error(
                f"You enabled {self.__class__.__name__} but did not set an API key!"
            )
            self.errorState = True
            return

        if self.opts["api_hostname"] == "":
            self.error(
                f"You enabled {self.__class__.__name__} but did not set an API hostname!"
            )
            self.errorState = True
            return

        if eventData in self.results:
            self.debug(f"Skipping {eventData}, already checked.")
            return

        self.results[eventData] = True

        if eventName.startswith("AFFILIATE") and not self.opts['checkaffiliates']:
            return

        if eventName in ['IP_ADDRESS', 'IPV6_ADDRESS']:
            blacklist_type = "BLACKLISTED_IPADDR"
            malicious_type = 'MALICIOUS_IPADDR'
        elif eventName in ['AFFILIATE_IPADDR', 'AFFILIATE_IPV6_ADDRESS']:
            blacklist_type = "BLACKLISTED_AFFILIATE_IPADDR"
            malicious_type = 'MALICIOUS_AFFILIATE_IPADDR'
        else:
            self.debug(f"Unexpected event type {eventName}, skipping")
            return

        self.debug(f"Checking maliciousness of IP address {eventData} with ThreatJammer.com")

        ip_info = self.queryIp(eventData)

        if ip_info is None:
            self.sf.error(f"Error processing JSON response for {eventData} from ThreatJammer.com")
            return

        score = ip_info.get('score')
        if not score:
            self.sf.error(f"No risk score found for {eventData} from ThreatJammer.com. Skipping.")
            return