` @Ҡ d Z ddlZddlZddlmZ ddlmZmZmZm Z ddl
m Z m Z ddl
mZmZ ddlmZ ddlmZ G d d
e Zd ed ed
efdZd ed ed
efdZd ed ed
efdZd ed ed
efdZded
efdZ d)dedededz de dz de dz de dz de dz d e dz d edz d edz d e dz fd Z d!e e d
e e fd"Z d#efd$Z d ed
e fd%Z!d&e dz d
efd'Z"d
e dz fd(Z#dS )*a0 Helper functions for WordPress CVE protection incidents.
WordPress incidents are stored in a dedicated wordpress_incident table with
plugin-specific data stored in the extra_info JSON field.
This module provides helper functions to work with WordPress incidents.
Available for both AV and IM360 modes.
N) timedelta) CharField
FloatField IntegerField TextField) JSONFieldfn)Modelinstance)apply_order_by)OrderByc R e Zd ZdZ edd Z ed Z ed Z e d Z
ed Z ed Z ed Z
ed Z ed Z edd Z edd Z ed Z G d d
ZdS ) WordpressIncidentz
WordPress incident model for CVE protection.
Uses dedicated wordpress_incident table created in migration 191.
Unique constraint on (abuser, name, plugin, rule, severity, domain)
allows deduplication similar to the aggregate plugin.
T) primary_keynull)r
country_id)r column_nameN)r defaultc $ e Zd Zej ZdZdZdS )WordpressIncident.Metawordpress_incident)))abusernamepluginruleseveritydomainTN)__name__
__module__ __qualname__r dbdatabasedb_tableindexes ]/opt/imunify360/venv/lib/python3.11/site-packages/defence360agent/model/wordpress_incident.pyMetar 1 s! ;'
r& r( )r r r __doc__r idr r r r timestampretriesr r r descriptionr countryr r
extra_infor( r% r& r' r r s&
$T 2 2 2B
YD
!
!
!F 9$ D
%%%Il%%%G|&&&H 9$ D)&&&K
YD
!
!
!FiT|<<?? M%%j11 ]&&{33 }(( 77! "
)).99# $
1 12H I I% & =,,->??' ( &)).99#%!%%j113 r& c | d pt | }t | | }d| dd t | dd dt | d d | d
d || d p| d
| d |d
S )a
Build complete incident dict ready for database insertion.
This is used for both single incident creation and bulk insertion.
Args:
incident_data: Dict with incident fields from PHP incident file
site_info: Dict with site information (domain, site_path, username, user_id)
Returns:
Dict with all fields ready for Incident.create() or bulk insert
message wordpressrule_idunknowntsr r8 zWordPress CVE: r7 Unknown REMOTE_ADDR attacker_ipr )
r r r+ r, r r r- r r r/ )rX build_message_fallbackr\ floatcalculate_severity)r0 r1 r^ r/ s r' build_incident_dictrj g s ** .D/ /G "-;;J !!)Y77=,,T15566&}'8'8'@'@AAG-"3"3E9"E"EGG ##M22 , ] + +--)) r& c D t | | }t j di |S )aD
Create a WordPress incident in the wordpress_incident table.
Args:
incident_data: Dict with incident fields from PHP incident file
site_info: Dict with site information (domain, site_path, username)
Returns:
WordpressIncident instance with WordPress fields populated in extra_info
r% )rj r create)r0 r1
incident_dicts r' create_wordpress_incidentrn s* (
yAAM # 4 4m 4 44r& c t | | }t j di | t j t j t j t j t j t j gt j
t j
dz t j |d i t
}t | d S )ai
Insert or update a WordPress incident in the wordpress_incident table.
If an incident with the same aggregate key (abuser, name, plugin, rule,
severity, domain) exists, increment its retries counter and update timestamp.
Otherwise, create a new incident with retries=1.
This implements similar deduplication logic as the aggregate plugin.
Args:
incident_data: Dict with incident fields from PHP incident file
site_info: Dict with site information (domain, site_path, username, user_id)
Returns:
WordpressIncident instance (either newly created or updated)
rc r+ )conflict_targetupdater r% )rj r insert on_conflictr r r r r r r, r+ returningexecutelist)r0 r1 rm results r' upsert_wordpress_incidentrx s & (
yAAM 11=11 !(!&!(!&!*!(
")+<+Dq+H!+];-G
$ % % # * <<?r& incidentc
| j | j | j | j | j | j | j | j | j | j | j
| j d S )z
Convert a WordpressIncident model instance to a dictionary.
Args:
incident: WordpressIncident model instance
Returns:
Dictionary representation of the incident
r* r r r+ r, r r r- r r. r r/ r{ )ry s r' wordpress_incident_to_dictr| sU k/
'# %
+/#/ )
r& limitoffsetr> by_abuser_ipby_country_code by_domainsearch site_searchsincetoorder_byc Z t t t j dk } |6| t j t j d |k } |2| t j | } |#| t j |k } |2| t j
| } || t j | t j | z t j
| z t j | z } |6| t j t j d |k } |6| t j
d |k } | 6| t j
d | k } |
pg } |
D ]T}
t |
t r(| t% j |
?| |
Ut) | t | } n1| t j
} | | } | | } d | D S )a
Get WordPress incidents as dictionaries.
Args:
limit: Maximum number of incidents to return
offset: Offset for pagination
user_id: Filter by user ID (None = all)
by_abuser_ip: Filter by abuser IP address (None = all)
by_country_code: Filter by country code (None = all)
by_domain: Filter by domain (None = all)
search: Search in IP address, name, description, or domain (None = all)
site_search: Filter by site path in extra_info (None = all)
since: Filter by timestamp >= this value (unix timestamp, None = all)
to: Filter by timestamp <= this value (unix timestamp, None = all)
order_by: List of fields to order by (None = default order by timestamp desc).
Can be either strings (e.g., ["timestamp+", "severity-"]) or
OrderBy objects. Strings are automatically converted.
Returns:
List of incident dictionaries
r_ Nz $.user_idz $.site_pathREALc , g | ]}t | S r% r| .0incs r'
z+get_wordpress_incidents..? s! G G G &s + + G G Gr& )r selectwherer r json_extractr/ r containsr. r r r- r+ cast
isinstancestrappendr
fromstringr r descr~ r ru )r~ r r> r r r r r r r r queryconverted_order_byitems r' get_wordpress_incidentsr s D
$ $%6 7 7 = = ![ 0
E O - 8+ F F
- 4 = =l K KLL" - 5 HII - 4 = =i H HII
" + +F 3 3 +44V<<
= &//77
8 &//77
8
O - 8- H H
- 7 < .W s! > > > &s + + > > >r& )r insert_manyrt ru )r rw s r' bulk_create_wordpress_incidentsr B sV %%n55 $ % % ? >v > > >>r& daysc R t j t | z
}t t j dk t j d |k z }|S )N)r r_ r )
timer
total_secondsr deleter r r+ r ru )r cutoff_timedeleteds r' delete_old_wordpress_incidentsr Z s )++ t 4 4 4 B B D DDK ""
%
4 *//77+E
G
Nr& c dg}| d r| | d | d r| | d | d r| | d | d r| | d | d r| | d d | S )z=Build message if plugin didn't provide one (per spec format).z
IM WP plugin:r` r7 r: r; r8 )rX r join)r0 partss r' rg rg g s
E## /
]9-... +
]5)*** ,
]6*+++## /
]9-... ,
]6*+++ 88E??r& r8 c & | dk rdS | dk rdS dS )z!Calculate severity based on mode.block pass r% )r8 s r' ri ri y s# wq
qqr& c ` | dS t | t r| S t j | S )z>Serialize a value to JSON string if it's not already a string.N)r r jsondumps)values r' rW rW s3 }t% :e r& ) r} r NNNNNNNNN)$r) r r datetimer peeweer r r r playhouse.sqlite_extr r defence360agent.modelr
r $defence360agent.model.simplificationr "defence360agent.rpc_tools.validater
r dictr\ rj rn rx r| intr rv r r r rg ri rW r% r& r' r sd / . . . . . . . 1 1 1 1 1 1 1 1 ? ? ? ? ? ? 6 6 6 6 6 6
>*D *T *d * * * *Z t F55$(55 5 5 5"--$(-- - - -`): t 6 #"& " ZH ZH ZH ZH 4ZZH * ZH
4Z ZH Tz
ZH
$JZH tZH :ZH d
ZH TkZH ZH ZH ZHz?J? $Z? ? ? ?0
$ 3 $S4Z C 3: r&