certsocietegenerale / fame

FAME Automates Malware Evaluation
https://certsocietegenerale.github.io/fame/
GNU General Public License v3.0
847 stars 168 forks source link

API hash case insensitive #96

Closed tcccorp closed 2 years ago

tcccorp commented 2 years ago

Description

on the api/getfile/hash_type/hash , is it possible to make the hash case insensitive ?

still on the same part, is it possible to remove the /hash_type/ and determine it by the length of the hash ?

gaelmuller commented 2 years ago

This should be possible and not too difficult to create a new endpoint for this. It would be a good first issue if anyone is looking to contribute.

tcccorp commented 2 years ago

hello Gael, thank for your reply

May I propose something like this ?

in web/views/files.py

import re
from flask import abort # add abort in flask import 

#  function to determine type of hash or if hash is correct

def return_hash_type(hash):
    dict_type_hash = {"64":"sha256", "40":"sha1", "32":"md5"}
    if re.match("[0-9a-fA-F]{" + str(len(hash)) + "}",hash):
            try:
                return dict_type_hash[str(len(hash))]
            except KeyError:
                return False
    else:
        return False
# a new url to find a hash

@route('/hash/<hash>', methods=["GET"])
def get_hash(self, hash):
    """Get the object with `hash`.

    .. :quickref: File; Get an object by a hash

    :param hash: hash of the object.

    :>json file file: list of files (see :http:get:`/files/(id)` for details on the format of a file).
    """
    hash_type = return_hash_type(hash)
    if hash_type != False:
        file = {'file': enrich_comments(clean_files(get_or_404(current_user.files, **{hash_type:hash.lower()})))}
        enrich_comments(file)
        return return_file(file)

    abort(404)  # is it correct ?
gaelmuller commented 2 years ago

I just pushed something based on your proposal so this should now be supported. Thank you for your contribution.