Fix explicit --type rejected when absent from describeTypes.json

[elhoim]

Finding 12 (Medium) — bin/cli.py:924

Problem

candidate_types is filtered against valid_types even for an explicit --type. guess_attribute_types already filters internally at :241, so this line only ever rejects explicit types - a module-declared type absent from GitHub's describeTypes.json is unusable.

Fix

Finding 12 (explicit-type-rejected, medium): at bin/cli.py:924, candidate_types was filtered against valid_types (loaded from GitHub's describeTypes.json) unconditionally. guess_attribute_types already applies this same filter internally for guessed types, so the second filter only ever affected explicit --type values — any module-declared input type absent from describeTypes.json (e.g. because describeTypes.json is stale, offline, or the module adds a custom type) was silently rejected even though the installed module explicitly supports it. Fix: when args.attr_type is set, accept the type if it is in valid_types OR in supported_input_types (the set of input types declared by installed expansion modules' mispattributes.input), instead of requiring membership in valid_types alone. Guessed types (the non-explicit path) are unaffected and still filtered against valid_types only, matching guess_attribute_types' existing internal behavior.

Verification

Reproduced against the unmodified code at 9b8c605, then re-checked after the change.

Before

Simulated the code path with valid_types={"ip-src","ip-dst","domain"} (describeTypes.json missing "btc") and supported_input_types={"btc","domain"} (an installed module declares btc as input), args.attr_type="btc":
candidate_types = [(args.attr_type, "explicitly provided by user")]
candidate_types = [(t, r) for t, r in candidate_types if t in valid_types]
Output: BEFORE FIX candidate_types: []  →  assertion "explicit type wrongly rejected (bug reproduced)" printed, confirming the module-supported explicit type was dropped.

After

Same setup, with the fix's branch (`if not args.attr_type: ... else: filter by valid_types or supported_input_types`):
Output: AFTER FIX candidate_types: [('btc', 'explicitly provided by user')]  →  "Fix verified: explicit --type btc is accepted because module supports it."
Also verified a genuinely bogus explicit type (not in either set) is still correctly rejected, so typo protection is preserved.

python bin/cli.py --help exits 0 and the module still imports cleanly. Verification was performed offline against the pure functions — no running misp-modules instance is required.

Branched from 9b8c605. This PR addresses only this finding; the other findings from the same review are in separate PRs, so they will need rebasing against each other as they merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DYX4TKA5inzByJ4qGWKjqh