From abc9d92c9d6e396eb594c922e0250102cc028e91 Mon Sep 17 00:00:00 2001
From: jesopo <github@lolnerd.net>
Date: Sun, 2 Sep 2018 11:44:06 +0100
Subject: [PATCH] Add check_urls.py, to opt-in check for malicious urls

---
 modules/check_urls.py | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 modules/check_urls.py

diff --git a/modules/check_urls.py b/modules/check_urls.py
new file mode 100644
index 00000000..d9fe05bc
--- /dev/null
+++ b/modules/check_urls.py
@@ -0,0 +1,34 @@
+#--require-config virustotal-api-key
+
+import re
+import Utils
+
+URL_VIRUSTOTAL = "https://www.virustotal.com/vtapi/v2/url/report"
+RE_URL = re.compile(r"https?://\S+", re.I)
+
+class Module(object):
+    def __init__(self, bot, events):
+        self.bot = bot
+        self.events = events
+        events.on("received.message.channel").hook(self.message)
+        events.on("postboot").on("configure").on(
+            "channelset").assure_call(setting="check-urls",
+            help="Enable/Disable automatically checking for malicious urls",
+            validate=Utils.bool_or_none)
+
+    def message(self, event):
+        match = RE_URL.search(event["message"])
+        if match and event["channel"].get_setting("check-urls",
+                event["server"].get_setting("check-urls", False)):
+            url = match.group(0)
+            page = Utils.get_url(URL_VIRUSTOTAL, get_params={
+                "apikey": self.bot.config["virustotal-api-key"],
+                "resource": url}, json=True)
+
+            if page:
+                if page.get("positives", 0) > 1:
+                    self.events.on("send.stdout").call(
+                        module_name="CheckURL", target=event["channel"],
+                        message="%s just send a malicous URL!" %
+                        event["user"].nickname)
+