From 786c72c5cdb61b5ae034cd809ac057b6ba38ad60 Mon Sep 17 00:00:00 2001
From: = <=>
Date: Fri, 22 Aug 2025 15:05:27 -0400
Subject: [PATCH] Fixed Logic error in allowed hashes

---
 AirlockTools.py        |  4 ++--
 utils/hashfunctions.py | 27 ++++++++++++---------------
 2 files changed, 14 insertions(+), 17 deletions(-)

diff --git a/AirlockTools.py b/AirlockTools.py
index 2bb3f2a..c59492b 100644
--- a/AirlockTools.py
+++ b/AirlockTools.py
@@ -15,7 +15,7 @@ dotenv.load_dotenv()
 
 url = "https://172.17.22.240:3129"
 badpublisherlist = ["Brave Software, Inc.",	"Zoom Video Communications, Inc."]
-path_exclusion_constant = 5
+path_exclusion_constant = 3
 treat_tolerance_constant = 4
 
 def apivalidation(): 
@@ -23,7 +23,7 @@ def apivalidation():
    _____  .__       .__                 __     ___________           .__          
   /  _  \ |__|______|  |   ____   ____ |  | __ \__    ___/___   ____ |  |   ______
  /  /_\  \|  \_  __ \  |  /  _ \_/ ___\|  |/ /   |    | /  _ \ /  _ \|  |  /  ___/
-/    |    \  ||  | \/  |_(  <_> )  \___|    <    |    |(  <_> |  <_> )  |__\___ \ 
+/    |    \  ||  | \/  |_(  <_> )  \___|    <    |    |(  <_> |  <_> )  |__\___ \ 4
 \____|__  /__||__|  |____/\____/ \___  >__|_ \   |____| \____/ \____/|____/____  >
         \/                           \/     \/                                 \/ 
 """)
diff --git a/utils/hashfunctions.py b/utils/hashfunctions.py
index 25d4819..5ea3dfa 100644
--- a/utils/hashfunctions.py
+++ b/utils/hashfunctions.py
@@ -68,34 +68,31 @@ def augmentAggregatedHashes(url, agg_df: pd.DataFrame) -> pd.DataFrame:
     aug_df = df[['sha256', 'filename_x', 'description', 'productname', 'productversion', 'publisher_y', 'publisher_x', 'netdomain', 'hostname', 'username', 'pprocess', 'gprocess', 'commandline', 'reputation_lastseen', 'reputation_scannercount', 'reputation_scannermatch', 'reputation_status', 'reputation_threatlevel', 'reputation_threatname', 'reputation_timestamp']]
     return aug_df
  
+
 def categorizeHashes(aug_df: pd.DataFrame, threat_tolerance: int, untrusted_publishers: list):
     if untrusted_publishers is None:
         untrusted_publishers = []
 
     df = aug_df.copy()
 
-    def reputationtool(row, threat_tolerance):
-        if row["reputation_scannermatch"] == "N/A":
-            return True
+    def reputationtool(row):
+        val = row["reputation_scannermatch"]
+        if pd.isna(val) or val == "N/A":
+            return True if row["publisher_y"] == "Not Signed" else False
         try:
-            if int(row["reputation_scannermatch"]) > threat_tolerance:
-                return True
+            return int(val) > threat_tolerance
         except (ValueError, TypeError):
-            pass
-        return False
+            return True if row["publisher_y"] == "Not Signed" else False
 
-    mask_needsreview = (df["publisher_y"] == "Not Signed") & df.apply(lambda row: reputationtool(row, threat_tolerance), axis=1)
+    df["reputation_flag"] = df.apply(reputationtool, axis=1)
+
+    mask_needsreview = (df["publisher_y"] == "Not Signed") & df["reputation_flag"]
 
     mask_approved = (
-    ((df["publisher_y"] != "Not Signed") & (~df["publisher_y"].isin(untrusted_publishers))) &
-    (df["publisher_y"] != "Not Signed")  # explicitly signed
-    ) | (
-    (df["publisher_y"] == "Not Signed") &
-    (~df.apply(lambda row: reputationtool(row, threat_tolerance), axis=1)) &
-    (~df["publisher_y"].isin(untrusted_publishers))  # exclude untrusted even if unsigned
+        ((df["publisher_y"] != "Not Signed") & ~df["publisher_y"].isin(untrusted_publishers)) |
+        ((df["publisher_y"] == "Not Signed") & ~df["reputation_flag"] & ~df["publisher_y"].isin(untrusted_publishers))
     )
 
-
     needsreview_df = df[mask_needsreview]
     approved_df = df[mask_approved]
     remaining_df = df[~(mask_needsreview | mask_approved)]