Refang

Refang defanged text and defang values for safe reports.

Functions:

• refang –

  Rewrite defanged text into plain text.

• refang_tracked –

  Refang text and map each output character back to the original.

• defang –

  Defang one indicator for a report.

Attributes:

• Span –

Span module-attribute

Span = tuple[int, int]

refang

refang(text: str, extra: Sequence[tuple[str, str]] | None = None) -> str

Rewrite defanged text into plain text.

Replacements, in order:

• hxxps to https, hxxp to http, fxp to ftp
• [.], (.), {.}, [dot], (dot), {dot}, and dot to .
• [at], (at), [@], and (@) to @
• [://] to :// and [:] to :

extra is a list of (regex, replacement) pairs applied before the built-in rules. Patterns are case-sensitive unless the regex says otherwise.

Parameters:

• text (str) –

  Arbitrary input. It is not required to contain indicators.

• extra (Sequence[tuple[str, str]] | None, default: None ) –

  Optional substitutions applied first.

Returns:

• str –

  The refanged string.

refang_tracked

refang_tracked(text: str, extra: Sequence[tuple[str, str]] | None = None) -> tuple[str, list[Span]]

Refang text and map each output character back to the original.

Each span is (start, end) in the original string. A replacement that shrinks the text, such as [.] to ., maps the new character onto the whole original slice.

Parameters:

• text (str) –

  Original input.

• extra (Sequence[tuple[str, str]] | None, default: None ) –

  Optional substitutions applied first.

Returns:

• tuple[str, list[Span]] –

  The refanged text and one span per output character.

defang

defang(value: str, kind: IOCType | str | None = None) -> str

Defang one indicator for a report.

Dots become [.]. URLs also rewrite a leading http to hxxp and a leading ftp to fxp (so https becomes hxxps). Email addresses rewrite the first @ as [at].

Parameters:

• value (str) –

  Indicator value, already refanged.

• kind (IOCType | str | None, default: None ) –

  Type key. Only url and email change more than the dots.

Returns:

• str –

  The defanged value.