From 1441dd8465b0c55e899a6ddecf3d18274295a271 Mon Sep 17 00:00:00 2001
From: DaRuudii <social@daruudii.com>
Date: Tue, 8 Oct 2019 19:30:16 +0200
Subject: [PATCH 1/2] Implement Mega Link Analyzer

---
 pastepwn/analyzers/__init__.py                |  4 +-
 pastepwn/analyzers/megalinkanalyzer.py        | 13 +++++
 .../analyzers/tests/megalinkanalyzer_test.py  | 53 +++++++++++++++++++
 3 files changed, 69 insertions(+), 1 deletion(-)
 create mode 100644 pastepwn/analyzers/megalinkanalyzer.py
 create mode 100644 pastepwn/analyzers/tests/megalinkanalyzer_test.py

diff --git a/pastepwn/analyzers/__init__.py b/pastepwn/analyzers/__init__.py
index 7d2e3e5..f84e45d 100644
--- a/pastepwn/analyzers/__init__.py
+++ b/pastepwn/analyzers/__init__.py
@@ -29,6 +29,7 @@
 from .facebookaccesstokenanalyzer import FacebookAccessTokenAnalyzer
 from .base64analyzer import Base64Analyzer
 from .slackwebhookanalyzer import SlackWebhookAnalyzer
+from .megalinkanalyzer import MegaLinkAnalyzer
 
 __all__ = (
     'AlwaysTrueAnalyzer',
@@ -59,5 +60,6 @@
     'EmailPasswordPairAnalyzer',
     'FacebookAccessTokenAnalyzer',
     'Base64Analyzer',
-    'SlackWebhookAnalyzer'
+    'SlackWebhookAnalyzer',
+    'MegaLinkAnalyzer'
 )
diff --git a/pastepwn/analyzers/megalinkanalyzer.py b/pastepwn/analyzers/megalinkanalyzer.py
new file mode 100644
index 0000000..bafcece
--- /dev/null
+++ b/pastepwn/analyzers/megalinkanalyzer.py
@@ -0,0 +1,13 @@
+# -*- coding: utf-8 -*-
+from .regexanalyzer import RegexAnalyzer
+
+
+class MegaLinkAnalyzer(RegexAnalyzer):
+    """
+    Analyzer to match mega links via regex
+    """
+    name = "MegaLinkAnalyzer"
+
+    def __init__(self, actions):
+        regex = r"(https?:\/\/)?mega\.nz\/#F![\w-]{8}(![\w-]{22}(![\w-]{8})?)?"
+        super().__init__(actions, regex)
diff --git a/pastepwn/analyzers/tests/megalinkanalyzer_test.py b/pastepwn/analyzers/tests/megalinkanalyzer_test.py
new file mode 100644
index 0000000..36bb2ce
--- /dev/null
+++ b/pastepwn/analyzers/tests/megalinkanalyzer_test.py
@@ -0,0 +1,53 @@
+# -*- coding: utf-8 -*-
+import unittest
+from unittest import mock
+
+from pastepwn.analyzers.megalinkanalyzer import MegaLinkAnalyzer
+
+
+class TestMegaLinkAnalyzer(unittest.TestCase):
+    def setUp(self):
+        self.analyzer = MegaLinkAnalyzer(None)
+        self.paste = mock.Mock()
+
+    def test_match_positive(self):
+        """Test if positives are recognized"""
+        # working mega link (short version)
+        self.paste.body = "https://mega.nz/#F!XTQVEAZZ"
+        self.assertTrue(self.analyzer.match(self.paste))
+
+        # working mega link (medium version)
+        self.paste.body = "https://mega.nz/#F!XTQVEAZZ!eqxlOvTxJKnvAkYvjC0O8g"
+        self.assertTrue(self.analyzer.match(self.paste))
+
+        # working mega link (long version)
+        self.paste.body = "https://mega.nz/#F!PB8SSawR!SUokSlF2Zy8CR004DNFfNw!LQtniCoa"
+        self.assertTrue(self.analyzer.match(self.paste))
+
+        # without https header
+        self.paste.body = "mega.nz/#F!XTQVEAZZ!eqxlOvTxJKnvAkYvjC0O8g"
+        self.assertTrue(self.analyzer.match(self.paste))
+
+        # http header
+        self.paste.body = "http://mega.nz/#F!XTQVEAZZ!eqxlOvTxJKnvAkYvjC0O8g"
+        self.assertTrue(self.analyzer.match(self.paste))
+
+        # in a sentence
+        self.paste.body = "check out this file:https://mega.nz/#F!PB8SSawR!SUokSlF2Zy8CR004DNFfNw!LQtniCoa"
+        self.assertTrue(self.analyzer.match(self.paste))
+
+    def test_match_negative(self):
+        """Test if negatives are not recognized"""
+        self.paste.body = ""
+        self.assertFalse(self.analyzer.match(self.paste))
+
+        self.paste.body = None
+        self.assertFalse(self.analyzer.match(self.paste))
+
+        # Invalid segment length
+        self.paste.body = "https://mega.nz/#F!XTQVEAZZ1!eqxlOvTxJKnvAkYvjC0O8g"
+        self.assertFalse(self.analyzer.match(self.paste))
+
+
+if __name__ == '__main__':
+    unittest.main()

From 5474b6e301a07ad9228f6608bfa1a946044a2cd4 Mon Sep 17 00:00:00 2001
From: DaRuudii <social@daruudii.com>
Date: Tue, 8 Oct 2019 19:36:18 +0200
Subject: [PATCH 2/2] Fixed failed test

changed regex to match url boundary
---
 pastepwn/analyzers/megalinkanalyzer.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pastepwn/analyzers/megalinkanalyzer.py b/pastepwn/analyzers/megalinkanalyzer.py
index bafcece..efd7b8c 100644
--- a/pastepwn/analyzers/megalinkanalyzer.py
+++ b/pastepwn/analyzers/megalinkanalyzer.py
@@ -9,5 +9,5 @@ class MegaLinkAnalyzer(RegexAnalyzer):
     name = "MegaLinkAnalyzer"
 
     def __init__(self, actions):
-        regex = r"(https?:\/\/)?mega\.nz\/#F![\w-]{8}(![\w-]{22}(![\w-]{8})?)?"
+        regex = r"\b(https?:\/\/)?mega\.nz\/#F![\w-]{8}(![\w-]{22}(![\w-]{8})?)?\b"
         super().__init__(actions, regex)