Require AS prefix for high-confidence ASN detection

[elhoim]

Finding 22 (Medium) — bin/cli.py:182

Problem

looks_like_asn's ^(AS)?\d{1,10}$ makes the prefix optional, so any bare 1-10 digit string scores 90 as an ASN - verified for '12345' and '443' (a pasted port number).

Fix

looks_like_asn used the regex ^(AS)?\d{1,10}$, making the "AS" prefix optional, so any bare 1-10 digit string (e.g. "12345", or a pasted port number like "443") scored 90 and was confidently guessed as an ASN attribute. Fixed by requiring the "AS" prefix for the 90-score match (regex now ^AS\d{1,10}$), and adding a separate low-confidence path (score 20) for bare digit strings via a new looks_like_bare_asn_digits helper, so the guess is still offered but ranked appropriately low rather than near-certain.

Verification

Reproduced against the unmodified code at 9b8c605, then re-checked after the change.

Before

python3 -c "import sys; sys.path.insert(0,'bin'); import cli; print(cli.guess_attribute_types('443', {'AS'}, set()))" -> [('AS', 'matches ASN syntax')] with internal score 90 (near top confidence) for a bare port number.

After

Same call after fix -> [('AS', "bare digits could be an ASN without the 'AS' prefix")] with internal score 20 (low confidence); "AS12345" still correctly scores 90 via looks_like_asn.

python bin/cli.py --help exits 0 and the module still imports cleanly. Verification was performed offline against the pure functions — no running misp-modules instance is required.

Branched from 9b8c605. This PR addresses only this finding; the other findings from the same review are in separate PRs, so they will need rebasing against each other as they merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DYX4TKA5inzByJ4qGWKjqh