Remove dead sort in guess_attribute_types

[elhoim]

Finding 33 (Low) — bin/cli.py:303-306

Problem

'ranked = sorted(...)' is immediately followed by 'ranked.sort(...)' whose key ends in the unique type name, making it a total order - the first sort's result can never survive. Pure wasted work.

Fix

Finding #33 (dead-sort, low severity) in bin/cli.py's guess_attribute_types: the code called sorted() to build ranked, then immediately called ranked.sort() with a different, finer-grained key (adding a supported_input_types check ahead of the score/name tiebreakers). Because the second sort is a total order over the same list, the first sorted() result was always discarded before being read — pure wasted work. Fix: removed the first sorted() call and sort best.items() exactly once, directly with the final combined key (x[0] not in supported_input_types, -x[2], x[0]). Net diff: -3/+1 line, no behavior change to the returned ranking, just removes the redundant computation.

Verification

Reproduced against the unmodified code at 9b8c605, then re-checked after the change.

Before

Reproduced by manually replaying the original two-step sort logic (git stash to the pre-fix code) with best = {"md5": ("32 hex characters", 95), "domain": ("looks like a domain name", 85)} and supported = {"domain","hostname"}:
  first = sorted(items, key=lambda x: (-x[2], x[0]))   -> order: ['md5', 'domain']
  second = first; second.sort(key=lambda x: (x[0] not in supported, -x[2], x[0]))  -> order: ['domain', 'md5']
Output:
  intermediate (first sorted) order: ['md5', 'domain']
  final (after .sort()) order:       ['domain', 'md5']
The intermediate order is completely superseded and never observed/returned, proving the first sorted() call is wasted work.

After

After the fix, bin/cli.py has a single sorted() call using the final combined key directly:
  ranked = sorted([...], key=lambda x: (x[0] not in supported_input_types, -x[2], x[0]))
Ran guess_attribute_types("d41d8cd98f00b204e9800998ecf8427e", valid_types={"md5","sha1","domain","hostname"}, supported={"domain","hostname"}) -> result: [('md5', '32 hex characters')] (same correct output as before, now computed with one sort instead of two).

python bin/cli.py --help exits 0 and the module still imports cleanly. Verification was performed offline against the pure functions — no running misp-modules instance is required.

Branched from 9b8c605. This PR addresses only this finding; the other findings from the same review are in separate PRs, so they will need rebasing against each other as they merge.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DYX4TKA5inzByJ4qGWKjqh