sroberts / hubot-vtr-scripts

Scripts for making Hubot a CND Sidekick
MIT License
59 stars 15 forks source link

Fix regex on reputation IP call (BUG) #50

Closed alexcpsec closed 9 years ago

alexcpsec commented 9 years ago

The regex is not greedy, so it usually stop on the first digit of the final octet as it parses.

The symptoms are easily reproducible, as below:

Alex Pinto [12:07 PM] 
! reputation ip 72.21.91.19

woodhouse [12:07 PM] 
72.21.91.1 IP Reputation:
- Robtex:     https://ip.robtex.com/72.21.91.1.html
- CentralOps: http://centralops.net/co/DomainDossier.aspx?addr=72.21.91.1&dom_dns=1&dom_whois=1&net_whois=1
- IPVoid:     http://www.ipvoid.com/scan/72.21.91.1/
- HE:         http://bgp.he.net/ip/72.21.91.1#_whois
- SANS ISC:   https://isc.sans.edu/api/ip/72.21.91.1

I will try to look into this in a couple of weeks.

sroberts commented 9 years ago

Gah that is problematic. This is why I keep meaning to work on https://github.com/sroberts/hubot-vtr-scripts/issues/3 to make sure there's a standard way to do these sorts of checks.

sroberts commented 9 years ago

So it's not perfect, but this I believe would be an improvement:

searchText.match(/\b[1-2]\d{1,2}\.[1-2]?\d{1,2}\.[1-2]?\d{1,2}\.[1-2]?\d{1,2}\b/im)
Beastcraft commented 9 years ago

@sroberts Just stumpled upon this bug. I fixed it for myself locally, so just try this one: \b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b

See it in action: http://regex101.com/r/gT6xF7/1

sroberts commented 9 years ago

@beastcraft Thanks so much for the suggestion. We have a lot of ideas on how to fix regexs in VTR and this fits in really nicely.

krmaxwell commented 9 years ago

That in fact is the regex I use in another project (likely from a similar source).