From fe86bb2fe2b73668762fad52e3be853611053cf4 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Mon, 13 Jul 2026 06:13:39 +0200 Subject: [PATCH] fix: preserve bracketed subject prefixes --- .../modules/import_mod/email_import.py | 1 - tests/test_email_import_subject_markers.py | 31 +++++++++++++++++++ 2 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 tests/test_email_import_subject_markers.py diff --git a/misp_modules/modules/import_mod/email_import.py b/misp_modules/modules/import_mod/email_import.py index 72bb5235..52187ec6 100644 --- a/misp_modules/modules/import_mod/email_import.py +++ b/misp_modules/modules/import_mod/email_import.py @@ -191,7 +191,6 @@ def dict_handler(request: dict): SUBJECT_MARKER_RE = re.compile(r""" ^\s* - (?:(?:\[[^\]]+\]\s*)*) (?: (?:re|fw|fwd|wg|aw|sv|tr|rv|vs) (?:\[\d+\])? diff --git a/tests/test_email_import_subject_markers.py b/tests/test_email_import_subject_markers.py new file mode 100644 index 00000000..12be6b42 --- /dev/null +++ b/tests/test_email_import_subject_markers.py @@ -0,0 +1,31 @@ +import sys +from types import ModuleType + + +def load_remove_common_subject_markers(): + pymisp = ModuleType("pymisp") + tools = ModuleType("pymisp.tools") + tools.EMailObject = object + tools.URLObject = object + tools.make_binary_objects = lambda *args, **kwargs: None + sys.modules.setdefault("pymisp", pymisp) + sys.modules.setdefault("pymisp.tools", tools) + + from misp_modules.modules.import_mod.email_import import remove_common_subject_markers + + return remove_common_subject_markers + + +def test_remove_common_subject_markers_preserves_meaningful_bracketed_prefixes(): + remove_common_subject_markers = load_remove_common_subject_markers() + + assert remove_common_subject_markers("[CASE-123] RE: malware") == "[CASE-123] RE: malware" + assert remove_common_subject_markers("[TLP:AMBER] RE: incident") == "[TLP:AMBER] RE: incident" + + +def test_remove_common_subject_markers_strips_leading_reply_forward_markers(): + remove_common_subject_markers = load_remove_common_subject_markers() + + assert remove_common_subject_markers("RE: malware") == "malware" + assert remove_common_subject_markers(" Fwd: RE: malware") == "malware" + assert remove_common_subject_markers("AW[2]: WG: incident") == "incident"