Add filename|sha512 detection to looks_like_filename_hash

[elhoim]

Finding 23 (Medium) — bin/cli.py:213-226

Problem

looks_like_filename_hash checks md5/sha1/sha256 but never sha512, although looks_like_sha512 exists. 'malware.exe|'+128 hex returns (False, []), so the valid MISP type filename|sha512 is never suggested.

Fix

looks_like_filename_hash() in bin/cli.py checked candidate hash values against md5/sha1/sha256 only, even though a looks_like_sha512() helper already existed elsewhere in the file. As a result, a value like "malware.exe|<128 hex chars>" was never recognized and the valid MISP attribute type filename|sha512 was never suggested to the user. The fix adds the missing if looks_like_sha512(right): candidates.append("filename|sha512") branch, mirroring the existing md5/sha1/sha256 branches exactly.

Verification

Reproduced against the unmodified code at 9b8c605, then re-checked after the change.

Before

python3 -c "
import importlib.util
spec = importlib.util.spec_from_file_location('cli', 'bin/cli.py')
cli = importlib.util.module_from_spec(spec); spec.loader.exec_module(cli)
print(cli.looks_like_filename_hash('malware.exe|' + 'a'*128))
"
-> BEFORE: (False, [])

After

Same script after the fix:
-> AFTER: (True, ['filename|sha512'])

python bin/cli.py --help exits 0 and the module still imports cleanly. Verification was performed offline against the pure functions — no running misp-modules instance is required.

Branched from 9b8c605. This PR addresses only this finding; the other findings from the same review are in separate PRs, so they will need rebasing against each other as they merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DYX4TKA5inzByJ4qGWKjqh