def clean(self):
h = self.value.lower()
if not re.match(r'^[a-f0-9]+$', h):
raise ObservableValidationError("{} is not a valid hex hash".format(self.value))
self.family = self.HASH_LENGTHS.get((len(h) / 2) * 8)
if self.family is None:
raise ObservableValidationError("{} is not a valid hash (md5, sha1, sha224, sha256, sha384, sha512)".format(self.value))
self.value = h
def clean(self):
"""Ensures that URLs are canonized before saving"""
self.value = refang(self.value.strip())
try:
if re.match(r"[^:]+://", self.value) is None:
# if no schema is specified, assume http://
self.value = u"http://{}".format(self.value)
self.value = urlnorm.norm(self.value)
self.parse()
except urlnorm.InvalidUrl:
raise ObservableValidationError("Invalid URL: {}".format(self.value))
except UnicodeDecodeError:
raise ObservableValidationError("Invalid URL (UTF-8 decode error): {}".format(self.value))
def normalize(self):
self.value = refang(self.value)
try:
if re.match(r"[^:]+://", self.value) is None:
# if no schema is specified, assume http://
self.value = u"http://{}".format(self.value)
self.value = urlnorm.norm(self.value).replace(' ', '%20')
self.parse()
except urlnorm.InvalidUrl:
raise ObservableValidationError("Invalid URL: {}".format(
self.value))
except UnicodeDecodeError:
raise ObservableValidationError(
"Invalid URL (UTF-8 decode error): {}".format(self.value))
def clean(self):
if self.check_type(self.value):
self.normalize()
else:
raise ObservableValidationError(
"'{}' is not a valid '{}'".format(self.value, self.__class__.__name__)
)
def guess_type(string):
"""Tries to guess the type of observable given a ``string``.
Args:
string: The string that will be used to guess the observable type from.
Returns:
An observable Class.
Raises:
ObservableValidationError if no type could be guessed.
"""
from core.observables import (
Url,
Ip,
Email,
Path,
Hostname,
Hash,
Bitcoin,
MacAddress,
)
if string and string.strip() != "":
for t in [Url, Ip, Email, Path, Hostname, Hash, Bitcoin, MacAddress]:
if t.check_type(string):
return t
raise ObservableValidationError(
"{} was not recognized as a viable datatype".format(string)
)
def clean(self):
"""Performs some normalization on hostnames before saving to the db"""
try:
self.normalize(self.value)
except Exception:
raise ObservableValidationError("Invalid hostname: {}".format(
self.value))
def normalize(self):
self.value = refang(self.value.lower())
try:
self.idna = unicode(idna.encode(self.value))
except idna.core.InvalidCodepoint:
pass
except Exception, e:
raise ObservableValidationError(e.message)
def normalize(self, hostname):
hostname = Hostname.check_type(hostname)
if not hostname:
raise ObservableValidationError(
"Invalid Hostname (check_type={}): {}".format(
Hostname.check_type(hostname), hostname))
self.idna = unicode(idna.encode(hostname.lower()))
self.value = unicode(idna.decode(hostname.lower()))
def clean(self):
if not (re.match(r"^(1|3)[\w]{25,34}$", self.value) and
(re.search("[A-Z]", self.value)
and re.search("[0-9]", self.value))):
raise ObservableValidationError(
"{} is not a valid Bitcoin address".format(self.value))
if self.value.startswith("1"):
self.format = "P2PKH"
else:
self.format = "P2SH"
def normalize(self):
self.value = refang(self.value.lower())
# Remove trailing dot if existing
if self.value.endswith("."):
self.value = self.value[:-1]
try:
self.idna = self.value
except idna.core.InvalidCodepoint:
pass
except Exception as e:
raise ObservableValidationError(e.with_traceback())
def normalize(self):
self.value = refang(self.value.lower())
# Remove trailing dot if existing
if self.value.endswith("."):
self.value = self.value[:-1]
try:
self.idna = unicode(idna.encode(self.value))
except idna.core.InvalidCodepoint:
pass
except Exception, e:
raise ObservableValidationError(e.message)
def clean(self):
"""Performs some normalization on IP addresses entered"""
ip = self.value
if iptools.ipv4.validate_ip(ip): # is IPv4
self.value = iptools.ipv4.hex2ip(iptools.ipv4.ip2hex(ip)) # normalize ip
self.version = 4
elif iptools.ipv6.validate_ip(ip): # is IPv6
self.value = iptools.ipv6.long2ip(iptools.ipv6.ip2long(ip)) # normalize ip
self.version = 6
else:
raise ObservableValidationError("{} is not a valid IP address".format(ip))
def normalize(self, hostname):
hostname = Hostname.check_type(hostname)
if not hostname:
raise ObservableValidationError(
"Invalid Hostname (check_type={}): {}".format(
Hostname.check_type(hostname), hostname))
self.value = unicode(hostname.lower())
try:
self.idna = unicode(idna.encode(hostname.lower()))
except idna.core.InvalidCodepoint:
pass
def normalize(self):
self.value = refang(self.value)
if re.match(r"[^:]+://", self.value) is None:
# if no schema is specified, assume http://
self.value = u"http://{}".format(self.value)
try:
self.value = url_normalize(self.value).replace(' ', '%20')
except Exception as e:
raise ObservableValidationError("Invalid URL: {}".format(
self.value))
try:
p = tldextract_parser(self.value)
self.value = self.value.replace(p.fqdn,
p.fqdn.encode("idna").decode(), 1)
self.parse()
except UnicodeDecodeError:
raise ObservableValidationError(
"Invalid URL (UTF-8 decode error): {}".format(self.value))
def clean(self):
h = self.value.lower()
if not re.match(r'^[a-f0-9]+$', h):
raise ObservableValidationError("{} is not a valid hex hash".format(self.value))
self.value = h
self.family = self.HASH_LENGTHS.get((len(h) / 2) * 8, "Unknown")
