pyproject.toml

[tool.poetry]
name = "pandora"
version = "1.9.0"
description = "Pandora analysis framework."
authors = ["Raphaël Vinot <raphael.vinot@circl.lu>"]
license = "AGPL-3.0-or-later"

[tool.poetry.scripts]
start = "bin.start:main"
stop = "bin.stop:main"
update = "bin.update:main"
shutdown = "bin.shutdown:main"
run_backend = "bin.run_backend:main"
unoserver_launcher = "bin.unoserver_launcher:main"
workers_manager = "bin.workers_manager:main"
start_website = "bin.start_website:main"
imap_fetcher = "bin.imap_fetcher:main"
background_processing = "bin.background_processing:main"
scripts_controller = "bin.scripts_controller:main"

[tool.poetry.dependencies]
python = "^3.9,<3.14"
redis = {version = "^5.2.1", extras = ["hiredis"]}
flask-restx = "^1.3.0"
gunicorn = {version = "^23.0.0", extras = ["setproctitle"]}
Flask-Moment = "^1.0.6"
Flask-Login = "^0.6.3"
Bootstrap-Flask = "^2.4.1"
PyYAML = "^6.0.2"
Flask-WTF = "^1.2.2"
validators = "^0.34.0"
python-magic = "^0.4.27"
PyMuPDF = "^1.25.1"
requests = "^2.32.3"
textract = {git = "https://github.com/rafiot/textract.git", branch = "master"}
PyExifTool = "^0.5.6"
eml-parser = "^2.0.0"
unoserver = "^3.1"
weasyprint = "^63.1"
extract-msg = {version = "^0.52.0"}
oletools = {version = "^0.60.2", extras = ["full"]}
py7zr = "^0.22"
jbxapi = "^3.23.0"
defusedxml = "^0.7.1"
mwdblib = "^4.5.0"
vt-py = "^0.19"
malwarebazaar = "^0.2.6"
yara-python = "^4.5.1"
svglib = "^1.5.1"
clamd = "^1.0.2"
rarfile = "^4.2"
publicsuffix2 = "^2.20191221"
pymispwarninglists = "^1.6"
pikepdf = "^9.5.1"
Pillow = "^11.1.0"
imapclient = "^3.0.1"
pyzipper = "^0.3.6"
pymisp = {version = "^2.5.4", extras = ["fileobjects"]}
python-dateutil = "^2.9.0.post0"
pycdlib = "^1.14.0"
werkzeug = "^3.1.3"
pyhashlookup = "^1.2.5"
pylookyloo = "^1.26.1"
hachoir = "^3.3.0"
aiohttp = "^3.11.11"
opencv-python = "^4.10.0.84"
typing-extensions = {version = "^4.12.2", python = "<3.11"}
# The libyall libs
dfvfs = "^20240505"
# The libyall libs that are sneakily for testing purpose only
setuptools = "^75.6.0"
beautifulsoup4 = {version= "^4.12.3", extras = ["lxml", "charset_normalizer"]}
psutil = "^6.1.1"

[tool.poetry.group.dev.dependencies]
pylint = "^3.3.3"
ipython = [
    {version = "^8.18", python = "<3.10"},
    {version = "^8.19", python = ">=3.10"}
]
mypy = "^1.14.1"
types-redis = {version = "^4.6.0.20241004"}
types-PyYAML = "^6.0.12.20241230"
types-requests = "^2.32.0.20241016"
types-python-dateutil = "^2.9.0.20241206"
types-psutil = "^6.1.0.20241221"
types-beautifulsoup4 = "^4.12.0.20241020"
bandit = {extras = ["toml"], version = "^1.8.0"}
flake8 = "^7.1.1"
semgrep = "^1.101.0"
types-tzlocal = "^5.1.0.1"

[build-system]
requires = ["poetry-core"]
build-backend = "poetry.core.masonry.api"

[tool.bandit]
exclude_dirs = ["tasks"]
skips = [
    "B101",
    "B603", # subprocess call - check for execution of untrusted input.
    "B404", # Import subprocess
    "B607" # Start a subprocess
]

[tool.pylint.main]
# Analyse import fallback blocks. This can be used to support both Python 2 and 3
# compatible code, which means that the block might have code that exists only in
# one or another interpreter, leading to false positives when analysed.
# analyse-fallback-blocks =

# Always return a 0 (non-error) status code, even if lint errors are found. This
# is primarily useful in continuous integration scripts.
# exit-zero =

# A comma-separated list of package or module names from where C extensions may
# be loaded. Extensions are loading into the active Python interpreter and may
# run arbitrary code.
# extension-pkg-allow-list =

# A comma-separated list of package or module names from where C extensions may
# be loaded. Extensions are loading into the active Python interpreter and may
# run arbitrary code. (This is an alternative name to extension-pkg-allow-list
# for backward compatibility.)
# extension-pkg-whitelist =

# Return non-zero exit code if any of these messages/categories are detected,
# even if score is above --fail-under value. Syntax same as enable. Messages
# specified are enabled, while categories only check already-enabled messages.
# fail-on =

# Specify a score threshold under which the program will exit with error.
fail-under = 9.0

# Interpret the stdin as a python script, whose filename needs to be passed as
# the module_or_package argument.
# from-stdin =

# Files or directories to be skipped. They should be base names, not paths.
ignore = ["CVS"]

# Add files or directories matching the regular expressions patterns to the
# ignore-list. The regex matches against paths and can be in Posix or Windows
# format. Because '\' represents the directory delimiter on Windows systems, it
# can't be used as an escape character.
# ignore-paths =

# Files or directories matching the regular expression patterns are skipped. The
# regex matches against base names, not paths. The default value ignores Emacs
# file locks
ignore-patterns = ["^\\.#"]

# List of module names for which member attributes should not be checked (useful
# for modules/projects where namespaces are manipulated during runtime and thus
# existing member attributes cannot be deduced by static analysis). It supports
# qualified module names, as well as Unix pattern matching.
# ignored-modules =

# Python code to execute, usually for sys.path manipulation such as
# pygtk.require().
# init-hook =

# Use multiple processes to speed up Pylint. Specifying 0 will auto-detect the
# number of processors available to use, and will cap the count on Windows to
# avoid hangs.
jobs = 1

# Control the amount of potential inferred values when inferring a single object.
# This can help the performance when dealing with large functions or complex,
# nested conditions.
limit-inference-results = 100

# List of plugins (as comma separated values of python module names) to load,
# usually to register additional checkers.
# load-plugins =

# Pickle collected data for later comparisons.
persistent = true

# Minimum Python version to use for version dependent checks. Will default to the
# version used to run pylint.
py-version = "3.9"

# Discover python modules and packages in the file system subtree.
# recursive =

# When enabled, pylint would attempt to guess common misconfiguration and emit
# user-friendly hints instead of false-positive error messages.
suggestion-mode = true

# Allow loading of arbitrary C extensions. Extensions are imported into the
# active Python interpreter and may run arbitrary code.
# unsafe-load-any-extension =

[tool.pylint.basic]
# Naming style matching correct argument names.
argument-naming-style = "snake_case"

# Regular expression matching correct argument names. Overrides argument-naming-
# style. If left empty, argument names will be checked with the set naming style.
# argument-rgx =

# Naming style matching correct attribute names.
attr-naming-style = "snake_case"

# Regular expression matching correct attribute names. Overrides attr-naming-
# style. If left empty, attribute names will be checked with the set naming
# style.
# attr-rgx =

# Bad variable names which should always be refused, separated by a comma.
bad-names = ["foo", "bar", "baz", "toto", "tutu", "tata"]

# Bad variable names regexes, separated by a comma. If names match any regex,
# they will always be refused
# bad-names-rgxs =

# Naming style matching correct class attribute names.
class-attribute-naming-style = "any"

# Regular expression matching correct class attribute names. Overrides class-
# attribute-naming-style. If left empty, class attribute names will be checked
# with the set naming style.
# class-attribute-rgx =

# Naming style matching correct class constant names.
class-const-naming-style = "UPPER_CASE"

# Regular expression matching correct class constant names. Overrides class-
# const-naming-style. If left empty, class constant names will be checked with
# the set naming style.
# class-const-rgx =

# Naming style matching correct class names.
class-naming-style = "PascalCase"

# Regular expression matching correct class names. Overrides class-naming-style.
# If left empty, class names will be checked with the set naming style.
class-rgx = "[A-Z][a-z]+"

# Naming style matching correct constant names.
const-naming-style = "UPPER_CASE"

# Regular expression matching correct constant names. Overrides const-naming-
# style. If left empty, constant names will be checked with the set naming style.
# const-rgx =

# Minimum line length for functions/classes that require docstrings, shorter ones
# are exempt.
docstring-min-length = -1

# Naming style matching correct function names.
function-naming-style = "snake_case"

# Regular expression matching correct function names. Overrides function-naming-
# style. If left empty, function names will be checked with the set naming style.
# function-rgx =

# Good variable names which should always be accepted, separated by a comma.
good-names = ["i", "j", "k", "ex", "Run", "_"]

# Good variable names regexes, separated by a comma. If names match any regex,
# they will always be accepted
# good-names-rgxs =

# Include a hint for the correct naming format with invalid-name.
# include-naming-hint =

# Naming style matching correct inline iteration names.
inlinevar-naming-style = "any"

# Regular expression matching correct inline iteration names. Overrides
# inlinevar-naming-style. If left empty, inline iteration names will be checked
# with the set naming style.
# inlinevar-rgx =

# Naming style matching correct method names.
method-naming-style = "snake_case"

# Regular expression matching correct method names. Overrides method-naming-
# style. If left empty, method names will be checked with the set naming style.
# method-rgx =

# Naming style matching correct module names.
module-naming-style = "snake_case"

# Regular expression matching correct module names. Overrides module-naming-
# style. If left empty, module names will be checked with the set naming style.
# module-rgx =

# Colon-delimited sets of names that determine each other's naming style when the
# name regexes allow several styles.
# name-group =

# Regular expression which should only match function or class names that do not
# require a docstring.
no-docstring-rgx = "^_"

# List of decorators that produce properties, such as abc.abstractproperty. Add
# to this list to register other decorators that produce valid properties. These
# decorators are taken in consideration only for invalid-name.
property-classes = ["abc.abstractproperty"]

# Regular expression matching correct type variable names. If left empty, type
# variable names will be checked with the set naming style.
# typevar-rgx =

# Naming style matching correct variable names.
variable-naming-style = "snake_case"

# Regular expression matching correct variable names. Overrides variable-naming-
# style. If left empty, variable names will be checked with the set naming style.
# variable-rgx =

[tool.pylint.classes]
# Warn about protected attribute access inside special methods
# check-protected-access-in-special-methods =

# List of method names used to declare (i.e. assign) instance attributes.
defining-attr-methods = ["__init__", "__new__", "setUp", "__post_init__"]

# List of member names, which should be excluded from the protected access
# warning.
exclude-protected = ["_asdict", "_fields", "_replace", "_source", "_make"]

# List of valid names for the first argument in a class method.
valid-classmethod-first-arg = ["cls"]

# List of valid names for the first argument in a metaclass class method.
valid-metaclass-classmethod-first-arg = ["cls"]

[tool.pylint.design]
# List of regular expressions of class ancestor names to ignore when counting
# public methods (see R0903)
# exclude-too-few-public-methods =

# List of qualified class names to ignore when counting class parents (see R0901)
# ignored-parents =

# Maximum number of arguments for function / method.
max-args = 5

# Maximum number of attributes for a class (see R0902).
max-attributes = 7

# Maximum number of boolean expressions in an if statement (see R0916).
max-bool-expr = 5

# Maximum number of branch for function / method body.
max-branches = 12

# Maximum number of locals for function / method body.
max-locals = 15

# Maximum number of parents for a class (see R0901).
max-parents = 7

# Maximum number of public methods for a class (see R0904).
max-public-methods = 20

# Maximum number of return / yield for function / method body.
max-returns = 6

# Maximum number of statements in function / method body.
max-statements = 50

# Minimum number of public methods for a class (see R0903).
min-public-methods = 2

[tool.pylint.exceptions]
# Exceptions that will emit a warning when caught.
overgeneral-exceptions = ["BaseException", "Exception"]

[tool.pylint.format]
# Expected format of line ending, e.g. empty (any line ending), LF or CRLF.
# expected-line-ending-format =

# Regexp for a line that is allowed to be longer than the limit.
ignore-long-lines = "^\\s*(# )?<?https?://\\S+>?$"

# Number of spaces of indent required inside a hanging or continued line.
indent-after-paren = 4

# String used as indentation unit. This is usually "    " (4 spaces) or "\t" (1
# tab).
indent-string = "    "

# Maximum number of characters on a single line.
max-line-length = 160

# Maximum number of lines in a module.
max-module-lines = 1000

# Allow the body of a class to be on the same line as the declaration if body
# contains single statement.
# single-line-class-stmt =

# Allow the body of an if to be on the same line as the test if there is no else.
# single-line-if-stmt =

[tool.pylint.imports]
# List of modules that can be imported at any level, not just the top level one.
# allow-any-import-level =

# Allow wildcard imports from modules that define __all__.
# allow-wildcard-with-all =

# Deprecated modules which should not be used, separated by a comma.
# deprecated-modules =

# Output a graph (.gv or any supported image format) of external dependencies to
# the given file (report RP0402 must not be disabled).
# ext-import-graph =

# Output a graph (.gv or any supported image format) of all (i.e. internal and
# external) dependencies to the given file (report RP0402 must not be disabled).
# import-graph =

# Output a graph (.gv or any supported image format) of internal dependencies to
# the given file (report RP0402 must not be disabled).
# int-import-graph =

# Force import order to recognize a module as part of the standard compatibility
# libraries.
# known-standard-library =

# Force import order to recognize a module as part of a third party library.
known-third-party = ["enchant"]

# Couples of modules and preferred modules, separated by a comma.
# preferred-modules =

[tool.pylint.logging]
# The type of string formatting that logging methods do. `old` means using %
# formatting, `new` is for `{}` formatting.
logging-format-style = "old"

# Logging modules to check that the string format arguments are in logging
# function parameter format.
logging-modules = ["logging"]

[tool.pylint."messages control"]
# Only show warnings with the listed confidence levels. Leave empty to show all.
# Valid levels: HIGH, CONTROL_FLOW, INFERENCE, INFERENCE_FAILURE, UNDEFINED.
confidence = ["HIGH", "CONTROL_FLOW", "INFERENCE", "INFERENCE_FAILURE", "UNDEFINED"]

# Disable the message, report, category or checker with the given id(s). You can
# either give multiple identifiers separated by comma (,) or put this option
# multiple times (only on the command line, not in the configuration file where
# it should appear only once). You can also use "--disable=all" to disable
# everything first and then re-enable specific checks. For example, if you want
# to run only the similarities checker, you can use "--disable=all
# --enable=similarities". If you want to run only the classes checker, but have
# no Warning level messages displayed, use "--disable=all --enable=classes
# --disable=W".
disable = ["raw-checker-failed", "bad-inline-option", "locally-disabled", "file-ignored", "suppressed-message", "useless-suppression", "deprecated-pragma", "use-symbolic-message-instead", "bare-except", "invalid-name"]

# Enable the message, report, category or checker with the given id(s). You can
# either give multiple identifier separated by comma (,) or put this option
# multiple time (only on the command line, not in the configuration file where it
# should appear only once). See also the "--disable" option for examples.
enable = ["c-extension-no-member"]

[tool.pylint.method_args]
# List of qualified names (i.e., library.method) which require a timeout
# parameter e.g. 'requests.api.get,requests.api.post'
timeout-methods = ["requests.api.delete", "requests.api.get", "requests.api.head", "requests.api.options", "requests.api.patch", "requests.api.post", "requests.api.put", "requests.api.request"]

[tool.pylint.miscellaneous]
# List of note tags to take in consideration, separated by a comma.
notes = ["FIXME", "XXX", "TODO"]

# Regular expression of note tags to take in consideration.
# notes-rgx =

[tool.pylint.refactoring]
# Maximum number of nested blocks for function / method body
max-nested-blocks = 5

# Complete name of functions that never returns. When checking for inconsistent-
# return-statements if a never returning function is called then it will be
# considered as an explicit return statement and no message will be printed.
never-returning-functions = ["sys.exit", "argparse.parse_error"]

[tool.pylint.reports]
# Python expression which should return a score less than or equal to 10. You
# have access to the variables 'fatal', 'error', 'warning', 'refactor',
# 'convention', and 'info' which contain the number of messages in each category,
# as well as 'statement' which is the total number of statements analyzed. This
# score is used by the global evaluation report (RP0004).
evaluation = "max(0, 0 if fatal else 10.0 - ((float(5 * error + warning + refactor + convention) / statement) * 10))"

# Template used to display messages. This is a python new-style format string
# used to format the message information. See doc for all details.
# msg-template =

# Set the output format. Available formats are text, parseable, colorized, json
# and msvs (visual studio). You can also give a reporter class, e.g.
# mypackage.mymodule.MyReporterClass.
# output-format =

# Tells whether to display a full report or only the messages.
# reports =

# Activate the evaluation score.
score = true

[tool.pylint.similarities]
# Comments are removed from the similarity computation
ignore-comments = true

# Docstrings are removed from the similarity computation
ignore-docstrings = true

# Imports are removed from the similarity computation
ignore-imports = true

# Signatures are removed from the similarity computation
ignore-signatures = true

# Minimum lines number of a similarity.
min-similarity-lines = 4

[tool.pylint.spelling]
# Limits count of emitted suggestions for spelling mistakes.
max-spelling-suggestions = 4

# Spelling dictionary name. Available dictionaries: none. To make it work,
# install the 'python-enchant' package.
# spelling-dict =

# List of comma separated words that should be considered directives if they
# appear at the beginning of a comment and should not be checked.
spelling-ignore-comment-directives = "fmt: on,fmt: off,noqa:,noqa,nosec,isort:skip,mypy:"

# List of comma separated words that should not be checked.
# spelling-ignore-words =

# A path to a file that contains the private dictionary; one word per line.
# spelling-private-dict-file =

# Tells whether to store unknown words to the private dictionary (see the
# --spelling-private-dict-file option) instead of raising a message.
# spelling-store-unknown-words =

[tool.pylint.string]
# This flag controls whether inconsistent-quotes generates a warning when the
# character used as a quote delimiter is used inconsistently within a module.
# check-quote-consistency =

# This flag controls whether the implicit-str-concat should generate a warning on
# implicit string concatenation in sequences defined over several lines.
# check-str-concat-over-line-jumps =

[tool.pylint.typecheck]
# List of decorators that produce context managers, such as
# contextlib.contextmanager. Add to this list to register other decorators that
# produce valid context managers.
contextmanager-decorators = ["contextlib.contextmanager"]

# List of members which are set dynamically and missed by pylint inference
# system, and so shouldn't trigger E1101 when accessed. Python regular
# expressions are accepted.
# generated-members =

# Tells whether missing members accessed in mixin class should be ignored. A
# class is considered mixin if its name matches the mixin-class-rgx option.
# Tells whether to warn about missing members when the owner of the attribute is
# inferred to be None.
ignore-none = true

# This flag controls whether pylint should warn about no-member and similar
# checks whenever an opaque object is returned when inferring. The inference can
# return multiple potential results while evaluating a Python object, but some
# branches might not be evaluated, which results in partial inference. In that
# case, it might be useful to still emit no-member and other checks for the rest
# of the inferred objects.
ignore-on-opaque-inference = true

# List of symbolic message names to ignore for Mixin members.
ignored-checks-for-mixins = ["no-member", "not-async-context-manager", "not-context-manager", "attribute-defined-outside-init"]

# List of class names for which member attributes should not be checked (useful
# for classes with dynamically set attributes). This supports the use of
# qualified names.
ignored-classes = ["optparse.Values", "thread._local", "_thread._local", "argparse.Namespace"]

# Show a hint with possible names when a member name was not found. The aspect of
# finding the hint is based on edit distance.
missing-member-hint = true

# The minimum edit distance a name should have in order to be considered a
# similar match for a missing member name.
missing-member-hint-distance = 1

# The total number of similar names that should be taken in consideration when
# showing a hint for a missing member.
missing-member-max-choices = 1

# Regex pattern to define which classes are considered mixins.
mixin-class-rgx = ".*[Mm]ixin"

# List of decorators that change the signature of a decorated function.
# signature-mutators =

[tool.pylint.variables]
# List of additional names supposed to be defined in builtins. Remember that you
# should avoid defining new builtins when possible.
# additional-builtins =

# Tells whether unused global variables should be treated as a violation.
allow-global-unused-variables = true

# List of names allowed to shadow builtins
# allowed-redefined-builtins =

# List of strings which can identify a callback function by name. A callback name
# must start or end with one of those strings.
callbacks = ["cb_", "_cb"]

# A regular expression matching the name of dummy variables (i.e. expected to not
# be used).
dummy-variables-rgx = "_+$|(_[a-zA-Z0-9_]*[a-zA-Z0-9]+?$)|dummy|^ignored_|^unused_"

# Argument names that match this expression will be ignored.
ignored-argument-names = "_.*|^ignored_|^unused_"

# Tells whether we should check for unused import in __init__ files.
# init-import =

# List of qualified module names which can have objects that can redefine
# builtins.
redefining-builtins-modules = ["six.moves", "past.builtins", "future.builtins", "builtins", "io"]