Don't tag in-scope events as affiliate

bbot/core/event/base.py

@@ -549,7 +549,11 @@ def tags(self, tags):
     def add_tag(self, tag):
         if self._tags is None:
             self._tags = set()
-        self._tags.add(sys.intern(tagify(tag)))
+        tag = tagify(tag)
+        # an in-scope event is never an affiliate (refresh_scope_tags covers events that become in-scope later)
+        if tag == "affiliate" and getattr(self, "_scope_distance", None) == 0:
+            return
+        self._tags.add(sys.intern(tag))
 
     def add_tags(self, tags):
         for tag in set(tags):

bbot/test/test_step_1/test_events.py

@@ -314,6 +314,24 @@ def _http_response(url):
         assert tag in affiliate_event2.tags
         assert tag not in affiliate_event3.tags
 
+    # an in-scope event is never an affiliate, whether tagged directly or inheriting it
+    in_scope_parent = scan.make_event("https://evilcorp.com/", "URL", parent=root_event, tags=["status-200"])
+    in_scope_parent.scope_distance = 0
+    tagged_in_scope = scan.make_event(
+        "https://evilcorp.com/a", "URL_UNVERIFIED", parent=in_scope_parent, tags="affiliate"
+    )
+    assert tagged_in_scope.scope_distance == 0
+    assert "affiliate" not in tagged_in_scope.tags
+    out_of_scope_affiliate = scan.make_event(
+        "https://evilcorp.net/", "URL_UNVERIFIED", parent=in_scope_parent, tags="affiliate"
+    )
+    assert out_of_scope_affiliate.scope_distance == 1
+    assert "affiliate" in out_of_scope_affiliate.tags
+    in_scope_child = scan.make_event("https://evilcorp.net/b", "URL_UNVERIFIED", parent=out_of_scope_affiliate)
+    assert "affiliate" in in_scope_child.tags
+    in_scope_child.scope_distance = 0
+    assert "affiliate" not in in_scope_child.tags
+
     # discovery context
     event = scan.make_event(
         "127.0.0.1", parent=scan.root_event, context="something discovered {event.type}: {event.data}"