Add option to strip common reply/forward markers from email subject

[adulau]

Motivation

• Users reported that imported email subjects contain repeated reply/forward markers (e.g. RE:, Fwd:, WG:) which pollute the email-subject attribute; the module should optionally normalize these.

Description

• Add a new configuration option remove_subject_markers to moduleconfig and update the moduleinfo["features"] text to document it.
• Wire the option into dict_handler so when remove_subject_markers is enabled the module calls strip_subject_markers(email_object) before producing the MISP object.
• Implement SUBJECT_MARKER_RE, remove_common_subject_markers(subject) and strip_subject_markers(email_object) helpers to repeatedly remove leading reply/forward markers and bracketed tags while avoiding replacing the subject with an empty string.
• The strip logic updates subject attributes via email_object.get_attributes_by_relation("subject") and leaves unchanged subjects that would become empty after stripping.

Testing

• Compiled the modified module with python -m py_compile misp_modules/modules/import_mod/email_import.py and it succeeded.
• Executed inline Python assertions with a stubbed pymisp.tools environment validating remove_common_subject_markers against multiple example subjects and strip_subject_markers behavior on a mock object, and all assertions passed.
• Ran repository static checks (git diff --check) with no reported issues.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 34fe9bee36

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve non-reply bracketed subject prefixes

When marker stripping is enabled for subjects that begin with a meaningful bracketed prefix before the reply marker, such as [CASE-123] RE: malware or [TLP:AMBER] RE: incident, this subpattern consumes and drops the bracketed text along with RE:. That loses analyst-relevant context even though the option is described as removing common reply/forward markers; please avoid matching arbitrary bracketed prefixes or restrict it to known disposable markers.

Useful? React with 👍 / 👎.

[adulau]

@codex can you propose a fix?

[chatgpt-codex-connector]

To use Codex here, create an environment for this repo.