абузы: extract промокодов/сумм/ссылок в API и панели, +16 проверенных источников (TG/reddit/discourse/RSS/github/HN), чистка HTML в деталях, клэмп days

tools/fresh_candidates.py

@@ -7,9 +7,11 @@
 import datetime
 
 
-def d(name, category, kind, url, adapter="rss", tags=(), limit=15, detail=False, extra=None):
-    return {"name": name, "category": category, "kind": kind, "url": url, "adapter": adapter,
-            "tags": tuple(tags), "limit": limit, "detail": detail, "extra": extra or {}}
+def d(name, category, kind, url, adapter="rss", tags=(), limit=15, detail=False, extra=None, **kw):
+    row = {"name": name, "category": category, "kind": kind, "url": url, "adapter": adapter,
+           "tags": tuple(tags), "limit": limit, "detail": detail, "extra": extra or {}}
+    row.update(kw)
+    return row
 
 
 _NOW = datetime.datetime.utcnow()
@@ -35,7 +37,8 @@ CANDIDATES = [
     d("cisco_security_blog", "security", "rss", "https://blogs.cisco.com/security/feed", "rss", ("cti", "research")),
     d("checkpoint_research", "security", "rss", "https://research.checkpoint.com/feed/", "rss", ("research",)),
     d("redcanary_blog", "security", "rss", "https://redcanary.com/blog/feed/", "rss", ("dfir",)),
-    d("elastic_security_labs", "security", "rss", "https://www.elastic.co/security-labs/rss/feed", "rss", ("research",)),
+    # elastic_security_labs — в реестре уже есть https://www.elastic.co/security-labs/rss/feed.xml
+
     d("greynoise_blog", "security", "rss", "https://www.greynoise.io/blog/rss.xml", "rss", ("research",)),
     d("sekoia_blog", "security", "rss", "https://blog.sekoia.io/feed/", "rss", ("research",)),
     d("bitdefender_labs", "security", "rss", "https://www.bitdefender.com/blog/api/rss/labs/", "rss", ("research",)),
@@ -56,9 +59,10 @@ CANDIDATES = [
     d("infosec_writeups", "community", "rss", "https://infosecwriteups.com/feed", "rss", ("writeup",)),
 
     # ---------------- 2. CVE / vulnerabilities ----------------
-    d("nvd_recent", "security", "json",
-      "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=30&lastModStartDate=%s&lastModEndDate=%s"
-      % (_NVD_SINCE, _NVD_UNTIL), "nvd", ("cve", "nvd")),
+    # nvd_recent: окно last-modified считается в момент вызова (см. emit -> dynamic),
+    # статическая дата протухает уже через неделю.
+    d("nvd_recent", "security", "json", "https://services.nvd.nist.gov/rest/json/cves/2.0", "nvd",
+      ("cve", "nvd"), dynamic="NVD_LAST_WEEK"),
     d("nvd_exploited_kw", "security", "json",
       "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=25&keywordSearch=exploited%20in%20the%20wild",
       "nvd", ("cve", "exploited")),