egutierrez
6526da32dc
Extractores nuevos en python/functions/cybersecurity/: - extract_ip_addresses (IPv4 + IPv6 con validacion ipaddress) - extract_emails (RFC 5322 simplificado) - extract_domains (FQDNs con TLD valido, lista estatica) - extract_file_hashes (MD5/SHA1/SHA256/SHA512, algoritmo por longitud) - extract_crypto_wallets (BTC legacy + bech32, ETH 0x+40hex) - extract_cve_ids (CVE-YYYY-NNNN+) - extract_mac_addresses (xx:xx:xx + xx-xx-xx, separador uniforme) - extract_phone_numbers (E.164 + ES local 9 digitos) Pipeline: - extract_iocs corre todos, deduplica spans contenidos. Mantiene purity:pure (kind:function con uses_functions no vacio) porque la regla del registry exige que los pipelines sean impuros. Todas devuelven list[dict] con value/start/end/type para que el caller (issues 0038-0040) pueda reconciliar offsets con spans NER sin reparsing. Refs #0037 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
41 lines
1.1 KiB
Python
41 lines
1.1 KiB
Python
"""Extrae hashes MD5/SHA1/SHA256/SHA512 de un texto, con offsets y algoritmo."""
|
|
|
|
import re
|
|
|
|
# Mas largo primero para evitar que un SHA256 quede como SHA1+resto.
|
|
_HASH_LENGTHS = (
|
|
(128, "sha512"),
|
|
(64, "sha256"),
|
|
(40, "sha1"),
|
|
(32, "md5"),
|
|
)
|
|
|
|
_HASH_CANDIDATE = re.compile(r"\b[A-Fa-f0-9]{32,128}\b")
|
|
|
|
|
|
def extract_file_hashes(text: str) -> list[dict]:
|
|
"""Extrae hashes hex con su algoritmo deducido por longitud.
|
|
|
|
Reconoce MD5 (32), SHA1 (40), SHA256 (64) y SHA512 (128). Hashes
|
|
de longitudes intermedias se ignoran. Devuelve `algorithm` ademas
|
|
de los campos estandar.
|
|
"""
|
|
results = []
|
|
for m in _HASH_CANDIDATE.finditer(text):
|
|
candidate = m.group(0)
|
|
length = len(candidate)
|
|
algorithm = next(
|
|
(algo for size, algo in _HASH_LENGTHS if size == length),
|
|
None,
|
|
)
|
|
if algorithm is None:
|
|
continue
|
|
results.append({
|
|
"value": candidate,
|
|
"start": m.start(),
|
|
"end": m.end(),
|
|
"type": "file_hash",
|
|
"algorithm": algorithm,
|
|
})
|
|
return results
|