Fix MAC addresses and timestamps being guessed as IPv6 attributes

[elhoim]

Finding 36 (Low) — bin/cli.py:294-296

Problem

The colon-hex fallback matches anything made only of hex digits and colons, so MAC addresses and HH:MM:SS times are guessed as ip-src/ip-dst - 'de:ad:be:ef:00:01' returns [ip-dst, ip-src].

Fix

Fixed finding #36 (mac-as-ip, low severity): the colon-hex IPv6 fallback in guess_attribute_types() (bin/cli.py) used a blanket character-class regex ^[A-Fa-f0-9:]+$ that matched any hex-and-colon string, so MAC addresses (e.g. 'de:ad:be:ef:00:01') and HH:MM:SS timestamps were incorrectly guessed as ip-src/ip-dst. Added a new helper looks_like_ipv6_fragment() that requires genuine IPv6 group structure — either exactly 8 groups of 1-4 hex digits, or a single '::' compression with at most 7 total groups of 1-4 hex digits each — and replaced the old regex check with a call to it. This still catches partial/compressed IPv6 fragments (e.g. 'fe80::1') while rejecting 6-group 2-digit MAC addresses and 3-group timestamps.

Verification

Reproduced against the unmodified code at 9b8c605, then re-checked after the change.

Before

python3 -c "import re; v='de:ad:be:ef:00:01'; print(bool(re.match(r'^[A-Fa-f0-9:]+$', v) and ':' in v))" → True (old fallback fires on a MAC address, causing guess_attribute_types to add ip-src/ip-dst for 'de:ad:be:ef:00:01')

After

python3 -c "
import sys; sys.path.insert(0,'bin'); import cli
print('MAC:', cli.guess_attribute_types('de:ad:be:ef:00:01', {'ip-src','ip-dst'}, set()))
print('time:', cli.guess_attribute_types('12:34:56', {'ip-src','ip-dst'}, set()))
print('truncated v6:', cli.guess_attribute_types('fe80::1', {'ip-src','ip-dst'}, set()))
"
→ MAC: []   time: []   truncated v6: [('ip-dst', 'matches IPv6 syntax'), ('ip-src', 'matches IPv6 syntax')]

python bin/cli.py --help exits 0 and the module still imports cleanly. Verification was performed offline against the pure functions — no running misp-modules instance is required.

Branched from 9b8c605. This PR addresses only this finding; the other findings from the same review are in separate PRs, so they will need rebasing against each other as they merge.

🤖 Generated with Claude Code