Repository: smicallef/spiderfoot
File: modules/sfp_seon.py (Python)

Code before:

        self.sf.debug(f"Received event, {eventName}, from {srcModuleName}")

        if self.errorState:
            return None

        if self.opts['api_key'] == "":
            self.sf.error("You enabled sfp_seon but did not set an API key!")
            self.errorState = True
            return

        # Don't look up stuff twice
        if eventData in self.results:
            self.sf.debug(f"Skipping {eventData}, already checked.")
            return None
        else:
            self.results[eventData] = True

        if eventName == "IP_ADDRESS" or eventName == "IPV6_ADDRESS":
            data = self.query(eventData, eventName)
            if data is None:
                return None

            resultSet = data.get('data')
            if resultSet:
                if resultSet.get('score') >= self.opts['fraud_threshold']:
                    maliciousDesc = f"SEON [{eventData}]\n - FRAUD SCORE: {resultSet.get('score')}"
                    evt = SpiderFootEvent("MALICIOUS_IPADDR", maliciousDesc, self.__name__, event)
                    self.notifyListeners(evt)

                    if resultSet.get('tor'):
                        evt = SpiderFootEvent("WEBSERVER_TECHNOLOGY", f"Server is TOR node: {resultSet.get('tor')}", self.__name__, event)
                        self.notifyListeners(evt)

                    if resultSet.get('vpn'):
                        evt = SpiderFootEvent("WEBSERVER_TECHNOLOGY", f"Server is VPN: {resultSet.get('vpn')}", self.__name__, event)
                        self.notifyListeners(evt)

                    if resultSet.get('web_proxy'):
                        evt = SpiderFootEvent("WEBSERVER_TECHNOLOGY", f"Server is Web Proxy: {resultSet.get('web_proxy')}", self.__name__, event)
                        self.notifyListeners(evt)

                    if resultSet.get('public_proxy'):
                        evt = SpiderFootEvent("WEBSERVER_TECHNOLOGY", f"Server is Public Proxy: {resultSet.get('public_proxy')}", self.__name__, event)
                        self.notifyListeners(evt)

                if resultSet.get('country'):
                    location = ', '.join(filter(None, [resultSet.get('city'), resultSet.get('state_prov'), resultSet.get('country')]))
                    evt = SpiderFootEvent('GEOINFO', location, self.__name__, event)
                    self.notifyListeners(evt)


Review comment (suggestion):
When using `.get()` and expecting an integer for comparison, set `0` as the value to be returned in case the key isn't found (e.g. `resultSet.get('score', 0)`, so that you don't raise an exception for trying to compare a `None` with a number.

Code after:

        if res['code'] == '404':
            self.sf.error("API Endpoint not found")
            return None

        return json.loads(res['content'])

    # Handle events sent to this module
    def handleEvent(self, event):
        eventName = event.eventType
        srcModuleName = event.module
        eventData = event.data

        self.sf.debug(f"Received event, {eventName}, from {srcModuleName}")

        if self.errorState:
            return None

        if self.opts['api_key'] == "":
            self.sf.error("You enabled sfp_seon but did not set an API key!")
            self.errorState = True
            return

        # Don't look up stuff twice
        if eventData in self.results:
            self.sf.debug(f"Skipping {eventData}, already checked.")
            return None
        else:
            self.results[eventData] = True

        dataFound = False
        if eventName == "IP_ADDRESS" or eventName == "IPV6_ADDRESS":
            data = self.query(eventData, eventName)
            if data is None:
                return None

            resultSet = data.get('data')
            if resultSet:
                if resultSet.get('score', 0) >= self.opts['fraud_threshold']:
                    maliciousDesc = f"SEON [{eventData}]\n - FRAUD SCORE: {resultSet.get('score')}"
                    evt = SpiderFootEvent("MALICIOUS_IPADDR", maliciousDesc, self.__name__, event)
                    self.notifyListeners(evt)
                    dataFound = True

                    if resultSet.get('tor'):
                        evt = SpiderFootEvent("WEBSERVER_TECHNOLOGY", f"Server is TOR node: {resultSet.get('tor')}", self.__name__, event)
                        self.notifyListeners(evt)
                        dataFound = True

                    if resultSet.get('vpn'):
                        evt = SpiderFootEvent("WEBSERVER_TECHNOLOGY", f"Server is VPN: {resultSet.get('vpn')}", self.__name__, event)