jcsc 0 d Z ddlmZ ddlZddlZddlZddlZddlZddlm Z ddlm
Z
ddl m Z ddl
m
Z
ddlmZmZmZmZmZ dd lmZ dd
lmZmZmZmZmZm Z m Z m Z m Z m Z m!Z!m"Z" dd l#m$Z$ dd l%m&Z& dd
l'm(Z(m)Z) ddl*m+Z+m,Z,m-Z- ddl.m/Z/m0Z0m1Z1m2Z2 ddl3m4Z4m5Z5m6Z6m7Z7m8Z8 ddl9m:Z: G d de( Z; G d de( Z< e d G d d Z= G d de( Z> G d d e( Z? G d d e( Z@ G d d!e( ZAdS )"u
This program is free software: you can redistribute it and/or modify it under
the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License,
or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Copyright © 2019 Cloud Linux Software Inc.
This software is also available under ImunifyAV commercial license,
see
) annotationsN) dataclass)
attrgetter)Path)time)DictIterableListSetcast)reduce) SQL BooleanFieldCase CharFieldCheck
Expression
FloatFieldForeignKeyField IntegerFieldPrimaryKeyField TextFieldfn
model_to_dict)UserType)Modelinstance)
FilenameField
ScanPathFieldapply_order_by)execute_iterable_expressionget_abspath_from_user_dir get_results_iterable_expressionsplit_for_chunk)FAILED_TO_CLEANUPMalwareHitStatusMalwareScanResourceTypeMalwareScanTypeVulnerabilityHitStatus) get_crontabc ~ e Zd ZdZ G d d Z ed Z ed Z ed Z ed e
d e j
e j e j e j e j e j e j f g Z edd
Z edd Z edd
Z edd
Z ed e
d ej j ej j f g Z ed Z edd Z!e" de j
e j e j fd
dd Z#d
S ) MalwareScanzRepresents a batch of files scanned for malware
Usually a single AI-BOLIT execution.
See :class:`.MalwareScanType` for possible kinds of scans.
c e Zd Zej ZdZdS )MalwareScan.Meta
malware_scansN__name__
__module__ __qualname__r dbdatabasedb_table J/opt/imunify360/venv/lib/python3.11/site-packages/imav/malwarelib/model.pyMetar/ R s ;"r9 r; T primary_keyFnullz
type in {}r? constraintsr r? default Nresource_type in {}c 8 t t S Nintr r8 r9 r: zMalwareScan. s TVV r9 )typespathsc v | | j | j | j | j | j | j | j | j d | j
| j | | j |k | j |k }|r-| | j | }|
| j | j | j | j t j | | }|t' || | }| d t+ | fS )N scan_typeT clear_limit)selecttotal_resourcespathscanidstarted completederrortotal_malicioustypealias
resource_typewherein_group_byorder_byr- desclimitoffsetr! countlistdicts) clssincetora rb r_ rK rL querys r:
ondemand_listzMalwareScan.ondemand_list sd "
JJ#
#{++!
U38<<&&
'
'
U3;%'
(
(
U3;"$
%
% " 5KK U 3 344E
NN#SXsz3;
Xk)..00
1
1
U5\\
VF^^
"8S%88E{{t{,,d5;;==.A.AAAr9 rG )$r2 r3 r4 __doc__r; r rT r rU rV r formatr) ON_DEMANDREALTIMEMALWARE_RESPONSE
BACKGROUNDRESCANUSERRESCAN_OUTDATEDrY rR r rS r rW rX r( DBvalueFILEr[ initiator timestamp classmethodrj r8 r9 r: r- r- K s # # # # # # # #
Y4
(
(
(Fl&&&G $'''I 9
E ##'1'0'8'2'.','7
D& #lq999O =dB / / /D
I4 . . .E"lq999O I
E%,,/28/4:
M t$$$I %1D1DEEEI
/B
% &
/B /B /B /B [/B /B /Br9 r- c e Zd ZdZ G d d Z e Z eeddd Z e
d Z e
d Z e
d Z e
d Z edd Z e
d
Z e
d
Z ed
Z e
ej Z ed
Z e
d ed e j j e j j f g
Z e
d
Z! e
d
Z" e
d
Z# e
d
Z$ e
d
Z%e&d Z' G d d Z(e) d>d Z*e) d?d Z+e)d@d Z,e)ddd Z-e)d@d Z.e)dAd Z/e)dBd Z0e)dCd Z1e)d! Z2e) dDd" Z3e)dd#d$ Z4e)dEd' Z5e)d( Z6d) Z7e)dFdGd+ Z8e)dHd. Z9e)d/ Z:e)dCd0 Z;e)dCd1 Ze)d4 Z?e)d5 Z@eAdId; ZBd< ZCd= ZDdS )J
MalwareHitz*Represents a malicious or suspicious file.c e Zd Zej ZdZdS )MalwareHit.Meta malware_hitsNr1 r8 r9 r: r; r} s ;!r9 r; FhitsCASCADEr? related_name on_deleter> rB TrC rE r@ c T t t | j }t | S rG r str orig_filer selfr s r: orig_file_pathzMalwareHit.orig_file_path dn-- I r9 c $ e Zd Zed ZdS )MalwareHit.OrderByc t t j t j dft j dft j dft j dft j dffd fS )Nr d ) r r{ statusr' CLEANUP_PENDINGCLEANUP_STARTEDFOUND CLEANUP_DONECLEANUP_REMOVEDr8 r9 r: r zMalwareHit.OrderBy.status sb %)91=)91=)/3)6:)91=
r9 N)r2 r3 r4 staticmethodr r8 r9 r: OrderByr s-
r9 r r Nc , | | t t }|p
t }|t j |k t j |k z g}|5d| d}| t
d|f | j |z z |#| t j |k |#| t j |k |
"| t j
|
z |
rω r| | j dk | | j
fd|
D }|rrg }g }|D ]/}| d | | d 0d | }| t
d| d| t t j | }|}| "|t j | z }| | | | }| t- | t | }| | }d |D }||fS )
N% CAST(orig_file AS TEXT) LIKE ?filec ~ g | ]9}t | t k "| 7|:S r8 )len
startswith).0p site_searchs r:
z)MalwareHit._hits_list..E sM q66C , ,,, k1J1J, ,,,r9 zorig_file NOT LIKE ?z AND ()c 6 g | ]}| S r8 as_dictr rows r: r z)MalwareHit._hits_list..l 333C#++--333r9 )rQ r- joinr rU appendr userr{ rT r r[ r r r
operatorand_idr] r\ ra rb r! _hits_num) rf clausesrg rh ra rb search
by_scan_idr r_ by_statusidsr
user_siteskwargsr where_conditionspattern longer_paths
sql_chunks
sql_paramsrS combined_sql_string full_clausesmax_count_clausesordered max_countresults ` r:
_hits_listzMalwareHit._hits_list s $ zz#{++00==
\466
E
)k.AR.G H
#&mmmG # #4wjAA8W$&
# #JOt$; < < < ! # #K$6*$D E E E # #J$5$B C C C + # #C$5$? @ @ @ # #CM$<$<[$I$I J J J # L
( 2 2D %%&<=== %%jjj1111&-ll:&>&># ''2 /222J?? hm-=>> ) ? JM - -c 2 2 2L**\**0077>>vFF $Xz7CCGMM"344 337333& r9 c x |r&|r$|t j |k t j |k z z }||| j |k z }| t j | j t | }|t |t | }| S rG ) r- rU r rQ r COUNTr r r\ r! r{ scalar)rf r rg rh r r_ qs r: r zMalwareHit._hits_nump s R +u4#r)
G sx4' 'G JJrx'' ( ( - -k : : @ @ I I xQ77Axxzzr9 c | | j t j | j z ||| S rG )r r not_inr' CLEANUP malicious)rf rg rh r s r:
malicious_numzMalwareHit.malicious_num s? }}
Z
/ 7
8
83=
H
r9 )ignore_cleanedc | j }|r'|| j t j z } | j |g|R i |S rG )r r r r' r r )rf r argsr r s r: malicious_listzMalwareHit.malicious_list sR - C sz(()9)ABB BG s~g7777777r9 c F d |D }d }t ||| || S )Nc g | ] }|j
S r8 r r s r: r z)MalwareHit.set_status.. '''3'''r9 c d|i}|||d< |j di | |j | S )Nr
cleaned_atr8 updater\ r r] )r rf r r fields_to_updates r:
expressionz)MalwareHit.set_status..expression U & %1; . 3:11 01177
3HH Hr9 r" )rf r r r r s r:
set_statuszMalwareHit.set_status F ''$''' I I I + c6:
r9 to_deleterd c F d |D } fd}t || S )Nc g | ] }|j
S r8 r r s r: r z/MalwareHit.delete_instances.. s 111SV111r9 c j | S rG )deleter\ r r] )r rf s r: r z/MalwareHit.delete_instances..expression s+ ::<<%%cfjjoo66 6r9 r )rf r r s ` r: delete_instanceszMalwareHit.delete_instances sA 11y111 7 7 7 7 7 +:yAAAr9 to_updatec |D ][}| D ]D\ }}| D ]\ }}t ||| | E\d S rG )itemssetattrsave)rf r data _instancenew_fields_datafieldru s r: update_instanceszMalwareHit.update_instances s ! !D.2jjll
!
!* ?$3$9$9$;$; 5 5LE5Iue4444
! ! !r9 returnr c ` | j t j g | j z }|S rG )r r] r' r r )rf r s r: is_infectedzMalwareHit.is_infected s:
JNN$*
m
r9 c | j S rG )r rf s r:
is_suspiciouszMalwareHit.is_suspicious s
~ r9 c T fd}t t ||| |d S )Nc |j }| ||j | z }nSr(||j t
j z }n)r'||j t
j z }|5t |t r|g}||j
| z }| | S rG )
r r r] r r r' r
RESTORABLE
isinstancer r rQ r\ ) chunk_of_idsrf r r cleanuprestores r: r z/MalwareHit.malicious_select..expression s mG'36::l333
G3:,,-=-EFFF
G3:>>*:*EFFF dC(( " 6D38<<---::<<%%g.. .r9 T)exec_expr_with_empty_iterrd r$ )rf r r r r r r s `` r: malicious_selectzMalwareHit.malicious_select sS / / / / / / +Cdd
r9 statusesc 2 fd}t || S )Nc j | }r |j z } | S rG r r] r rQ r\ filesr rf r s r: r z'MalwareHit.get_hits..expression T m''..G
43:>>(333::<<%%g.. .r9 r$ rf r r r s ` ` r: get_hitszMalwareHit.get_hits 4 / / / / / / /z5AAAr9 hits_infor c x d |D }d |D }d |D t t t j | t j | }fd|D }|S )Nc g | ] }|j
S r8 rS r entrys r: r z*MalwareHit.get_db_hits.. s 333333r9 c g | ] }|j
S r8 app_namer s r: r z*MalwareHit.get_db_hits.. s 6665666r9 c * g | ]}|j |j fS r8 rS r r s r: r z*MalwareHit.get_db_hits.. s! JJJuuz5>2JJJr9 c 4 g | ]}|j |j fv |S r8 r r )r hit
paths_appss r: r z*MalwareHit.get_db_hits.. s3
CM3<#@J#N#NC#N#N#Nr9 )rd r{ rQ r\ r r] r )rf r rL appsr r s @r: get_db_hitszMalwareHit.get_db_hits s 3333366I666JJ JJJ
U:'++E22
3
3
U:&**400
1
1
r9 c . fd}t || S )Nc j | S rG r r\ r r] r rf s r: r z*MalwareHit.delete_hits..expression / ::<<%%cm&7&7&>&>?? ?r9 r rf r r s ` r: delete_hitszMalwareHit.delete_hits 3 @ @ @ @ @ +:u===r9 c j t | | S rG )rY get_pk_exprr s r: refreshzMalwareHit.refresh s" Dzz~~dmmoo...r9 Iterable[MalwareHit]c L fd}t t || S )Nc }r3 t t }| j d | D S )Nc g | ] }|j
S r8 r r r s r: r z?MalwareHit.refresh_hits..expression.. s *B*B*Bc36*B*B*Br9 )rQ r- r r\ r r] )r ri rf include_scan_infos r: r z+MalwareHit.refresh_hits..expression si JJLLE
G
3 4499+FF;;svzz*B*BT*B*B*B C CDD Dr9 r )rf r r4 r s ` ` r: refresh_hitszMalwareHit.refresh_hits sC E E E E E E 3JEEFFFr9 rx rI c | | j |k | j t
j z | j d z S )NF)rQ r\ r r r] r' CLEANEDis_null)rf rx s r:
cleaned_sincezMalwareHit.cleaned_since s^ zz||!!
^y
(z~~ . 677
9~%%e,,
.
r9 c | | j t j j k S rG )rQ r\ r[ r( rt ru r s r: db_hitszMalwareHit.db_hits s4 zz||!! !8!;!A A
r9 c v | | j t j k S )z,Return db hits that are in queue for cleanup)r; r\ r r' r r s r: db_hits_pending_cleanupz"MalwareHit.db_hits_pending_cleanup 2 {{}}"" J*: :
r9 c v | | j t j k S )z3Return db hits for which the cleanup is in progress)r; r\ r r' r r s r: db_hits_under_cleanupz MalwareHit.db_hits_under_cleanup r> r9 c v | | j t j k S )z3Return db hits for which the restore is in progressr; r\ r r' CLEANUP_RESTORE_STARTEDr s r: db_hits_under_restorationz$MalwareHit.db_hits_under_restoration" s2 {{}}"" J*B B
r9 c < d |D }d |D }d |D | | j | | j | }fd|D S )z
Return db hits for which the cleanup is in progress
specified by the provided set of MalwareDatabaseHitInfo
c h | ] }|j
S r8 r r hit_infos r: z6MalwareHit.db_hits_under_cleanup_in..1 s ???hHM???r9 c h | ] }|j
S r8 r rG s r: rI z6MalwareHit.db_hits_under_cleanup_in..2 s GGGh)GGGr9 c * h | ]}|j |j fS r8 r rG s r: rI z6MalwareHit.db_hits_under_cleanup_in..3 s/
3;X]H - .
r9 c 4 g | ]}|j |j fv |S r8 r )r r path_app_name_sets r: r z7MalwareHit.db_hits_under_cleanup_in..; s8
s|,0AAA
AAAr9 )r@ r\ r r] r )rf hit_info_setpath_set app_name_setri rM s @r: db_hits_under_cleanup_inz#MalwareHit.db_hits_under_cleanup_in) s @?,???GG,GGG
?K
% % ' '
U3=$$X..
/
/
U3<##L11
2
2
r9 c v | | j t j k S rG )r; r\ r r' CLEANUP_RESTORE_PENDINGr s r: db_hits_pending_cleanup_restorez*MalwareHit.db_hits_pending_cleanup_restoreA 0 {{}}"" J*B B
r9 c v | | j t j k S rG rB r s r: db_hits_under_cleanup_restorez(MalwareHit.db_hits_under_cleanup_restoreG rU r9
hit_list_listList['MalwareHit'] attributer Dict[str, List['MalwareHit']]c t d t j | D t | }d t j |t | D S )Nc 3 K | ]}|V d S rG r8 r3 s r: z0MalwareHit.group_by_attribute..R " I ISS I I I I I Ir9 keyc 4 i | ]\ }}|t | S r8 rd r
attr_valuer s r:
z1MalwareHit.group_by_attribute..U 4
D
T
r9 sorted itertoolschain
from_iterabler groupbyrZ rX hit_lists r: group_by_attributez MalwareHit.group_by_attributeM I IIO 9 9- H H I I I9%%
$-$5 y))% % %
r9 c i d| j d| j d| j d| j j d| j d| j j d| j d| j d | j d
| j d | j
d | j d
| j di d| j
d| j d| j | j | j | j t$ j j k rQt+ t, t, j t, j t, j t, j | j k t, j | j k t, j | j k t, j
| j
k t, j | j k t, j | j k t, j | j k t, j d t, j d t, j d
ng dS )Nr usernamer createdscan_idrN r[ rY hashsizer r r
extra_datadb_namer db_hostF)db_portsnippet table_fields) r r r rT rU scanid_idrY r[ rv rw r r r ry r rz r{ r| r( rt ru rd MalwareHistoryrQ
table_name table_field
table_row_infr\ rS ru r8 re r- s r: r zMalwareHit.as_dict] s ,
$',
,
DN,
t{* ,
t~ ,
)
,
T /,
DI,
DI,
DI,
,
dk,
$/,
" ,
t| ,
!,
"
t|#,
$ ||, %)@)C)III) "))&1&2&4
U&/4=@&.$,>&.$,>&.$,>&+t~=&48JJ&.$+=&199%@@&2::5AA&4<
[
. )- B B B B [B [ > > [> / / / G G G G [G
[
[
[
[
[
[
.
[
[
\
-
-
-
^N N N N Nr9 r{ T)frozenc e Zd ZU dZded< ded< ded< ded< ded< d ed
< ded < ded < d ed
< ded< ed Zed ZdS )MalwareHitAlternatezA
Used as a replacement for MalwareHit for file hits only
r rT r Noner r r rI rw rv rY rx boolr c
| ||d |d |d |d |d |d d d |d d d |d d d
S ) Nr r rw rv r r matchesrx
suspicious)
rT r r r r rw rv rY rx r r8 )rf rT filenamer s r: createzMalwareHitAlternate.create ss s w-f f f f a +6l1ok2 v,q/,77
r9 c N t t j | j S rG )r osfsdecoder r- s r: r z"MalwareHitAlternate.orig_file_path s BK//000r9 N) r2 r3 r4 rk __annotations__ry r r r r8 r9 r: r r s KKKNNNNNNJJJ
III
III
III
IIINNNOOO
[
1 1 X1 1 1r9 r c J e Zd ZdZ G d d ZdZ e Z e Z ed e
d g Z e dd Z
ed
Ze fd Ze fd Ze ddd Zedd Zed Z xZS )MalwareIgnorePathz+A path that must be excluded from all scansc $ e Zd Zej ZdZdZdS )MalwareIgnorePath.Metamalware_ignore_path)))rS r[ TN)r2 r3 r4 r r5 r6 r7 indexesr8 r9 r: r; r s ;(6r9 r; NFz resource_type in ('file','db')r@ c 8 t t S rG rH r8 r9 r: rJ zMalwareIgnorePath. s #dff++ r9 rB c t | | j }|| _ d S rG )rd rQ r_ rS re CACHE)rf r s r:
_update_cachez MalwareIgnorePath._update_cache s> SZZ\\**3844::<<== r9 c R d | _ t t | j di |S )Nr8 )r superr r )rf r r s r: r zMalwareIgnorePath.create s. 3u&,,3==f===r9 c ` d | _ t t | S rG )r r r r )rf r s r: r zMalwareIgnorePath.delete s' &,,33555r9 r[ r c \ | | j } | | | j |k } | | | j |k } |-| | j | } | | | j |k } || | } || | } |t || | } |t | }
| | j t |
dz | j t |
k z | j t t | k z } | d } | d | D fS )N/TrO c , g | ]}t | S r8 r r s r: r z:MalwareIgnorePath.paths_count_and_list.. s - - -C]3
- - -r9 )rQ r_ rS r\
added_datecontainsr[ rb ra r! r# r r r+ rc ) rf ra rb r r[ r rg rh r_ r user_homer s r: paths_count_and_listz&MalwareIgnorePath.paths_count_and_list s
JJLL ! !#( + + %/00A
>",--A ))&1122A $)]:;;A A A xa00A 1$77I$$S^^c%9::8s9~~-/8s;t#4#4 5 557 A GGG-- - -1 - - -
r9 r List[str]c : | j |i |\ }}d |D S )Nc g | ]
}|d S r r8 r s r: r z/MalwareIgnorePath.path_list..
s 111F 111r9 )r )rf r r _ path_lists r: r zMalwareIgnorePath.path_list s1 /s/@@@ 911y1111r9 c K | j | t | }| j D ]C}t j d d{V t |d }||k s ||j v r dS DdS )zChecks whether path stored in MalwareIgnorePath cache or
if it's belongs to path from cache or if it matches patters from cache
:param str check_path: path to check
:return: bool: is ignored according MalwareIgnorePath
Nr rS TF)r r r asynciosleepparents)rf
check_pathrS r ignored_paths r: is_path_ignoredz!MalwareIgnorePath.is_path_ignored s 9 J A-"" " " " " " " " & ??L $$,$,*F*Ftt +Gur9 )NNNNNNNN)r[ r )r r )r2 r3 r4 rk r; r r r r rS r r[ r r ry r r r r r r
__classcell__)r s @r: r r s 557 7 7 7 7 7 7 7
E B 9;;D I
'G!H!H I M 52E2EFFFJ [ > > > > [> 6 6 6 6 [6 !
&
&
&
&
[&
P 2 2 2 [2 [ r9 r c e Zd ZdZ G d d Z ed Z ed Z ed e d
e j j
e j j
f ge j j
Z ed Z ed Z ed Z ed Z ed Z edd
Z ed Z ed Z ed Z ed Z ed Z ed Z ed Z e dd Z e d
Z e dd Z!e dd Z"d S )r z:Records every event related to :class:`MalwareHit` recordsc e Zd Zej ZdZdS )MalwareHistory.Metamalware_historyNr1 r8 r9 r: r; r " s ;$r9 r; Fr> TrE )r? rA rC c 8 t t S rG rH r8 r9 r: rJ zMalwareHistory.C s S[[ r9 rB Nc | j |k | j |k z }|r/|| j | t d|f z z }|r|| j |k z }| | | | } |t |t | } t | }
|
d |
fS )Nz(INSTR(path, ?))TrO )ctimeeventr r file_userrQ r\ ra rb re r! r rd rc ) rf rg rh ra rb r r r_ r ri list_results r: get_historyzMalwareHistory.get_historyS s 9%#)r/: **622& 22
G - s}, ,G
""7++11%88??GGMMOO "8^UCCE5kk {{t{,,k99r9 c | j d| dd p t j | dd p t j | dd pt j j d| d S )Nrw causer[ )rw r r[ r8 )
insertpopr ROOTr) MANUALr( rv ru execute)rf r s r:
save_eventzMalwareHistory.save_eventg s
jjd33Dx}**Wd++E/E **_d;; 2&+1
')))))r9 r
List[dict]c t j 5 t |dt | j j z D ])}| | * d d d d S # 1 swxY w Y d S )Ni )
chunk_size) r r5 atomicr% r _metacolumns insert_manyr )rf r
hits_chunks r: save_eventszMalwareHistory.save_eventsq s
[
!
! 6 6
.CI,=(>(>!>
6
6
++335555
6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 6s ABB
BrL rd rg rI c > | | j t j | j | | j t k z | j |k z | j
S rG ) rQ rS r r r\ r] r r& r r^ tuples)rf rL rg s r: get_failed_cleanup_events_countz.MalwareHistory.get_failed_cleanup_events_count} s{
JJsx , ,
U U##9 1139%'
Xch
VXX
r9 )NNN)r r )rL rd rg rI )#r2 r3 r4 rk r; r rS r r r rl r( rt ru rv r[ r r rw
file_ownerr r r rz r{ ry r r r ru ry r r r r r8 r9 r: r r s: DD% % % % % % % %
=e $ $ $Dyd###H I
E%,,/28/4:
(,2
M
I5 ! ! !E
I5 ! ! !E u%%%I&&&J u%%%I Le-@-@ A A AEiT"""GiT"""GiT"""G%%%J)&&&K Ld+++MiT"""GHL: : : [:& [ 6 6 6 [ 6
[
r9 r c H e Zd ZdZ G d d Z e Z eeddd Z e
d Z e
d Z e
d Z e
d Z e
d Z e
d Z ed Z e
ej
Z ed Zed Zed$d Zed%d Z eddd Z ed Z e d&d Z ed Z e!d'd Z"ed(d! Z#ed)d" Z$d# Z%dS )*VulnerabilityHitz Represents a vulnerable file.c e Zd Zej ZdZdS )VulnerabilityHit.Metavulnerability_hitsNr1 r8 r9 r: r; r s ;'r9 r; Fvulnerabilitiesr r r> Tr c T t t | j }t | S rG r r s r: r z VulnerabilityHit.orig_file_path r r9 signaturer r r c , | d S )Nz
VULN-ESUS-)r )rf r s r: matchzVulnerabilityHit.match s ##L111r9 rd c t j d| x}r-| d d S g S )NzVULN-ESUS-([\d,]+)r ,)rer groupssplit)rf r r s r: get_vulnerability_idsz&VulnerabilityHit.get_vulnerability_ids sB I 3Y?? ?5 0<<>>!$**3// / r9 Nr c 2 fd}t || S )Nc j | }r |j z } | S rG r r
s r: r z-VulnerabilityHit.get_hits..expression r r9 r
r s ` ` r: r zVulnerabilityHit.get_hits r r9 c . fd}t || S )Nc j | S rG r$ r% s r: r z0VulnerabilityHit.delete_hits..expression r& r9 r r' s ` r: r( z VulnerabilityHit.delete_hits r) r9 r c d | | t t } |p
t }d | }
t j |k t j |k z }| |t
d|
f | j |
z z z }||| j |k z }||| j |k z }|
|| j | z z }|}|
|| j
|
z }| |
| | }|t || | }| t! j | j
t | }d |D }||fS )Nz%{}%r c 6 g | ]}| S r8 r r s r: r z/VulnerabilityHit._hits_list.. r r9 )rQ r- r r rl rU r r rT r r r] r\ ra rb r! r r r )rf rg rh ra rb r r r r_ r r r r r r r r r r s r: r zVulnerabilityHit._hits_list s zz#{++00==
\466--''#+u4 2 %
C07* 7" $
$L CH , ,L ! CJ* 4 4L CJ) 3 3L ( ? CFJJsOO +L**\**0077>>vFF $XsG<. r_ r9 r` c 4 i | ]\ }}|t | S r8 rc rd s r: rf z7VulnerabilityHit.group_by_attribute.. rg r9 rh rn s r: rp z#VulnerabilityHit.group_by_attribute rq r9 r list[int]c t }|D ]2}|t t |d z }3t | S )NrY )setr r rd )rf r vuln_idsr s r: get_vulnerabilities_idsz(VulnerabilityHit.get_vulnerabilities_ids sU 55 C 66s6{CC
HH H~~ r9 c F d |D }d }t ||| || S )Nc g | ] }|j
S r8 r r s r: r z/VulnerabilityHit.set_status.." r r9 c d|i}|||d< |j di | |j | S )Nr
patched_atr8 r )r rf r r r s r: r z/VulnerabilityHit.set_status..expression$ r r9 r )rf r r r r s r: r zVulnerabilityHit.set_status r r9 c | j | j | j | j j | j | j j | j | j | j | j | j
d S )N) r rs file_pathrt ru rN rY rv rw r r ) r r r rT rU r~ rY rv rw r r r- s r: r zVulnerabilityHit.as_dict1 sN ' {*~ )IIIk /
r9 )r r r r )r r r rd )
r NNNNNNNNN)rX r rZ r r r )r rd r r rG )&r2 r3 r4 rk r; r r r r- rT r r r r r rY rv rw r rx r*
VULNERABLEr r r r ry r r r r( r rd r rp r r r r8 r9 r: r r s ''( ( ( ( ( ( ( (
B
_
& F
I5 ! ! !E 9% D
5)))I 9% D 9$ D 9$ D
%%%I Y 5 @
A
A
AF&&&J
X 2 2 2 [2 [
)- B B B B [B > > [>
1! 1! 1! [1!f / / [/
\
[
[
r9 r c D e Zd ZdZ G d d Z ed ZdS )ImunifyPatchSubscriptionz(Stores Imunify Patch user subscriptions.c e Zd Zej ZdZdS ) ImunifyPatchSubscription.Metaimunify_patch_subscriptionsN)r2 r3 r4 r r5 r6 r r8 r9 r: r; r D s ;2
r9 r; Tr< N)r2 r3 r4 rk r; r user_idr8 r9 r: r r A sP 223 3 3 3 3 3 3 3 iD)))GGGr9 r )Brk
__future__r r rj r r r dataclassesr r pathlibr r typingr r r
r r functoolsr
peeweer r r r r r r r r r r r playhouse.shortcutsr defence360agent.contracts.configr defence360agent.modelr r $defence360agent.model.simplificationr r r! defence360agent.utilsr" r# r$ r% imav.malwarelib.configr& r' r( r) r* imav.malwarelib.scan.crontabr+ r- r{ r r r r r r8 r9 r: r s * # " " " " " ! ! ! ! ! ! 2 2 2 2 2 2 2 2 2 2 2 2 2 2
. - - - - - 5 5 5 5 5 5 1 1 1 1 1 1 1 1
5 4 4 4 4 4rB rB rB rB rB% rB rB rBjSN SN SN SN SN SN SN SNl $"1 "1 "1 "1 "1 "1 "1 "1J` ` ` ` ` ` ` `Fi
i
i
i
i
U i
i
i
Xs
s
s
s
s
u s
s
s
l* * * * *u * * * * *r9