[medium] Add filename|sha512 detection to looks_like_filename_hash

[elhoim]

BLUF — looks_like_filename_hash() never suggests filename|sha512, so sha512 file hashes go unguessed.

• Problem — looks_like_filename_hash() in bin/cli.py tests the hash half of a filename|hash value against md5, sha1 and sha256 only, even though a looks_like_sha512() helper already exists in the same file. malware.exe followed by 128 hex characters returns (False, []).
• Fix — Adds the missing looks_like_sha512 branch, mirroring the existing md5, sha1 and sha256 branches exactly.
• Effect — Users pasting a sha512 file hash now get the valid MISP type filename|sha512 offered as a type guess.

Finding 23 (Medium) — bin/cli.py:213-226

Problem

looks_like_filename_hash checks md5/sha1/sha256 but never sha512, although looks_like_sha512 exists. 'malware.exe|'+128 hex returns (False, []), so the valid MISP type filename|sha512 is never suggested.

Fix

looks_like_filename_hash() in bin/cli.py checked candidate hash values against md5/sha1/sha256 only, even though a looks_like_sha512() helper already existed elsewhere in the file. As a result, a value like "malware.exe|<128 hex chars>" was never recognized and the valid MISP attribute type filename|sha512 was never suggested to the user. The fix adds the missing if looks_like_sha512(right): candidates.append("filename|sha512") branch, mirroring the existing md5/sha1/sha256 branches exactly.

Verification

Reproduced against the unmodified code at 9b8c605, then re-checked after the change.

Before

python3 -c "
import importlib.util
spec = importlib.util.spec_from_file_location('cli', 'bin/cli.py')
cli = importlib.util.module_from_spec(spec); spec.loader.exec_module(cli)
print(cli.looks_like_filename_hash('malware.exe|' + 'a'*128))
"
-> BEFORE: (False, [])

After

Same script after the fix:
-> AFTER: (True, ['filename|sha512'])

python bin/cli.py --help exits 0 and the module still imports cleanly. Verification was performed offline against the pure functions — no running misp-modules instance is required.

Branched from 9b8c605. This PR addresses only this finding; the other findings from the same review are in separate PRs, so they will need rebasing against each other as they merge.

🤖 Generated with Claude Code