Skip to content

fix(import-document): prevent IP addresses being classified as phone numbers (#6677)#7065

Open
steadytao wants to merge 1 commit into
OpenCTI-Platform:masterfrom
steadytao:fix/import-document-ip-phone-classification
Open

fix(import-document): prevent IP addresses being classified as phone numbers (#6677)#7065
steadytao wants to merge 1 commit into
OpenCTI-Platform:masterfrom
steadytao:fix/import-document-ip-phone-classification

Conversation

@steadytao

Copy link
Copy Markdown

Proposed changes

  • prevent IP addresses matched by the phone-number expression from being classified as phone numbers
  • preserve the existing IP filtering behaviour
  • add regression tests for valid IPv4 addresses, filtered addresses and phone numbers

Related issues

Checklist

  • I consider the submitted work as finished
  • I have signed my commits using GPG key.
  • I tested the code for its functionality using different use cases

Copilot AI review requested due to automatic review settings July 21, 2026 02:56

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes a misclassification bug in the import-document connector where dotted IPv4 addresses could be matched by the phone-number regex and incorrectly emitted as Phone-Number observables. It adds a post-processing guard to drop “phone number” matches that are valid IPs, while keeping the existing IP whitelist/filter behavior intact.

Changes:

  • Discard Phone-Number.value matches that parse as valid IP addresses (so IPv4s won’t be reclassified as phone numbers).
  • Preserve existing IP filtering/whitelisting behavior (e.g., filtered IPs remain omitted rather than reappearing as phone numbers).
  • Add regression tests covering valid IPv4s, filtered IPv4s, and real phone-number matches.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
internal-import-file/import-document/src/reportimporter/report_parser.py Adds an ipaddress.ip_address() check to drop phone-number matches that are actually IP addresses.
internal-import-file/import-document/tests/test_report_parser_observables.py New regression tests ensuring IPv4s aren’t classified as phone numbers, filtered IPs stay filtered, and phone numbers still match.

@steadytao

Copy link
Copy Markdown
Author

Bit of a band-aid fix but phone number handling does have to be fairly broad for its intended use-case. Perhaps aligning against E.164 may be worth considering.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fix(import-document): IPv4 addresses extracted as Phone-Number observables by import-document connector

3 participants