From 3a0cbf971dc8ae891cd8cbd3b3429d9aa8076960 Mon Sep 17 00:00:00 2001 From: elhoim Date: Sun, 30 Aug 2026 23:47:56 +0000 Subject: [PATCH] Require AS prefix for high-confidence ASN detection looks_like_asn's regex made the 'AS' prefix optional, so any bare 1-10 digit string (e.g. '12345', or a pasted port number like '443') scored 90 and was guessed as an ASN attribute type. Now the prefix is required for the 90-score match, and a bare-digit string is still offered as a low-confidence ASN guess (score 20) rather than a near-certain one. --- bin/cli.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/bin/cli.py b/bin/cli.py index 92267b1..5d62e6d 100644 --- a/bin/cli.py +++ b/bin/cli.py @@ -180,7 +180,11 @@ def looks_like_email(value: str) -> bool: def looks_like_asn(value: str) -> bool: - return bool(re.match(r"^(AS)?\d{1,10}$", value, re.IGNORECASE)) + return bool(re.match(r"^AS\d{1,10}$", value, re.IGNORECASE)) + + +def looks_like_bare_asn_digits(value: str) -> bool: + return bool(re.match(r"^\d{1,10}$", value)) def looks_like_cve(value: str) -> bool: @@ -286,6 +290,8 @@ def add(t: str, reason: str, score: int) -> None: if looks_like_asn(v): add("AS", "matches ASN syntax", 90) + elif looks_like_bare_asn_digits(v): + add("AS", "bare digits could be an ASN without the 'AS' prefix", 20) if looks_like_domain(v): add("domain", "looks like a domain name", 85)