ioc-extractor/dist/aux/utils.cjs

IoC (Indicator of Compromise) extractor

"use strict";
var __create = Object.create;
var __defProp = Object.defineProperty;
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
var __getOwnPropNames = Object.getOwnPropertyNames;
var __getProtoOf = Object.getPrototypeOf;
var __hasOwnProp = Object.prototype.hasOwnProperty;
var __export = (target, all) => {
  for (var name in all)
    __defProp(target, name, { get: all[name], enumerable: true });
};
var __copyProps = (to, from, except, desc) => {
  if (from && typeof from === "object" || typeof from === "function") {
    for (let key of __getOwnPropNames(from))
      if (!__hasOwnProp.call(to, key) && key !== except)
        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
  }
  return to;
};
var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
  // If the importer is in node compatibility mode or this is not an ESM
  // file that has been converted to a CommonJS file using a Babel-
  // compatible transform (i.e. "__esModule" has not been set), then set
  // "default" to the CommonJS "module.exports" for node compatibility.
  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
  mod
));
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);

// src/aux/utils.ts
var utils_exports = {};
__export(utils_exports, {
  dedup: () => dedup,
  refang: () => refang,
  sortByValue: () => sortByValue,
  unicodeToASCII: () => unicodeToASCII
});
module.exports = __toCommonJS(utils_exports);
var import_punycode = __toESM(require("punycode.js"), 1);
function dedup(array) {
  return Array.from(new Set(array));
}
function sortByValue(array) {
  return array.sort();
}
function orRegExp(regexps) {
  return new RegExp(regexps.map((r) => r.source).join("|"), "gi");
}
function hasDot(s) {
  return ["\\.", " . ", "[.", "(.", "{.", "[dot", "(dot", "{dot"].some(
    (x) => s.includes(x)
  );
}
function hasColon(s) {
  return ["[:", "(:", "{:"].some((x) => s.includes(x));
}
function hasSlash(s) {
  return ["[/", "(/", "{/"].some((x) => s.includes(x));
}
function hasColonDoubleSlash(s) {
  return ["[://", "(://", "{://"].some((x) => s.includes(x));
}
function hasAt(s) {
  return ["[@", "(@", "{@", "[at", "(at", "{at"].some((x) => s.includes(x));
}
function hasHttp(s) {
  return ["hxxp", "h**p"].some((x) => s.includes(x));
}
function refang(s) {
  if (hasDot(s)) {
    s = s.replace(
      orRegExp([
        /\s\.\s/,
        /([[({])\.([\])}])/,
        /([[({])\./,
        /\.([\])}])/,
        /\\\./,
        /([[({])dot([\])}])/
      ]),
      "."
    );
  }
  if (hasColon(s)) {
    s = s.replace(/[[({]:[\])}]/g, ":");
  }
  if (hasSlash(s)) {
    s = s.replace(/[[({]\/[\])}]/g, "/");
  }
  if (hasColonDoubleSlash(s)) {
    s = s.replace(/[[({]:\/\/[\])}]/g, "://");
  }
  if (hasAt(s)) {
    s = s.replace(/[[({](?:at|@)[\])}]/gi, "@");
  }
  if (hasHttp(s)) {
    s = s.replace(/h(?:xx|\*\*)p(s?):\/\//gi, "http$1://");
  }
  return s;
}
function unicodeToASCII(s) {
  return import_punycode.default.toASCII(s);
}
// Annotate the CommonJS export names for ESM import in node:
0 && (module.exports = {
  dedup,
  refang,
  sortByValue,
  unicodeToASCII
});