абузы: extract промокодов/сумм/ссылок в API и панели, +16 проверенных источников (TG/reddit/discourse/RSS/github/HN), чистка HTML в деталях, клэмп days

omni/sources_fresh.py

@@ -5,6 +5,16 @@
 Импортов из omni.sources нет намеренно (циклический импорт).
 """
 
+import datetime as _dt
+
+
+def _nvd_week():
+    """NVD 2.0 принимает обе даты и окно <=120 дней: скользящая неделя."""
+    now = _dt.datetime.utcnow()
+    since = (now - _dt.timedelta(days=7)).strftime("%Y-%m-%dT00:00:00.000")
+    return ("https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=30"
+            "&lastModStartDate=%s&lastModEndDate=%s" % (since, now.strftime("%Y-%m-%dT%H:%M:%S.000")))
+
 
 def fresh(S):
     """S — конструктор Source; возвращает только проверенные сетью источники."""
@@ -33,7 +43,6 @@ def fresh(S):
         S("citizenlab", "security", "rss", "https://citizenlab.ca/feed/", "rss", ("apt", "research")),
         S("csoonline", "security", "rss", "https://www.csoonline.com/feed/", "rss", ("news")),
         S("cybersecuritydive", "security", "rss", "https://www.cybersecuritydive.com/feeds/news/", "rss", ("news")),
-        S("elastic_security_labs", "security", "rss", "https://www.elastic.co/security-labs/rss/feed", "rss", ("research")),
         S("github_advisories_api", "security", "json", "https://api.github.com/advisories?per_page=30&sort=published&direction=desc", "ghsa", ("cve", "ghsa")),
         S("habr_infosecurity", "security", "rss", "https://habr.com/ru/rss/hub/infosecurity/", "rss", ("ru", "research")),
         S("habr_news", "security", "rss", "https://habr.com/ru/rss/news/", "rss", ("ru", "news")),
@@ -45,6 +54,8 @@ def fresh(S):
         S("microsoft_security_blog", "security", "rss", "https://www.microsoft.com/en-us/security/blog/feed/", "rss", ("research")),
         S("mozilla_advisories", "security", "html", "https://www.mozilla.org/en-US/security/advisories/", "html_listing", ("cve", "browser")),
         S("ncsc_uk", "security", "rss", "https://www.ncsc.gov.uk/api/1/services/v1/all-rss-feed.xml", "rss", ("gov", "cve")),
+        S("nvd_exploited_kw", "security", "json", "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=25&keywordSearch=exploited%20in%20the%20wild", "nvd", ("cve", "exploited")),
+        S("nvd_recent", "security", "json", _nvd_week(), "nvd", ("cve", "nvd")),
         S("paloalto_blog", "security", "rss", "https://www.paloaltonetworks.com/blog/feed/", "rss", ("research")),
         S("seclists_fulldisclosure", "security", "rss", "https://seclists.org/rss/fulldisclosure.rss", "rss", ("mailing", "exploit")),
         S("seclists_nmap", "security", "rss", "https://seclists.org/rss/nmap-dev.rss", "rss", ("mailing")),