Merge pull request #82 from tlansec/bugfix/cidr_notation_ips

Avoid parsing CIDR notation IPs

Author: pedramamini

iocextract.py

@@ -245,7 +245,7 @@ def ipv4_len(ip_len=3):
                 [\[\(\\]*?\.[\]\)]*?
             ){3}
             (?:[1-9]?\d|1\d\d|2[0-4]\d|25[0-5])
-            (?:(?=[^\d\.])|$)
+            (?:(?=[^\d\.])|$)(?!\/\d{1,2}(?!\d))
         """,
             re.VERBOSE,
         )
@@ -262,7 +262,7 @@ def ipv4_len(ip_len=3):
             ){4}
             ([01]?[0-9]?[0-9]|2[0-4][0-9]|25[0-5])
             (?:[1-9]?\d|1\d\d|2[0-4]\d|25[0-5])
-            (?:(?=[^\d\.])|$)
+            (?:(?=[^\d\.])|$)(?!\/\d{1,2}(?!\d))
         """,
             re.VERBOSE,
         )
@@ -611,7 +611,6 @@ def ipv4_str(data):
         # Iterates over any ip address with 4 numbers after the final (3rd) octet
         for ip_address in ipv4_len(4).finditer(data):
             pass
-
         if refang:
             yield refang_ipv4(ip_address.group(0))
         else:

test_data/invalid.txt

@@ -8,3 +8,4 @@ x.x.x.x
 tooshor.t
 tooshor.
 adc83b191b1c6ea0fd8b46cd9f32e592fc
+100.20.30.0/24