From 0bb76724931bd79a2c34398487ba2055fb498b18 Mon Sep 17 00:00:00 2001
From: nightcityblade <nightcityblade@gmail.com>
Date: Fri, 24 Jul 2026 00:49:41 +0800
Subject: [PATCH] fix: block distribution fields on default galaxy clusters

---
 pymisp/mispevent.py                   |  2 +-
 tests/mispevent_testfiles/galaxy.json |  2 +-
 tests/test_galaxy_cluster.py          | 18 ++++++++++++++++++
 3 files changed, 20 insertions(+), 2 deletions(-)
 create mode 100644 tests/test_galaxy_cluster.py

diff --git a/pymisp/mispevent.py b/pymisp/mispevent.py
index 295ab8adf..6bcb83957 100644
--- a/pymisp/mispevent.py
+++ b/pymisp/mispevent.py
@@ -1442,7 +1442,7 @@ def from_dict(self, **kwargs: Any) -> None:
         self.default = kwargs.pop('default', False)
         # If the default field is set, we shouldn't have distribution or sharing group ID set
         if self.default:
-            blocked_fields = ["distribution" "sharing_group_id"]
+            blocked_fields = ["distribution", "sharing_group_id"]
             for field in blocked_fields:
                 if kwargs.get(field, None):
                     raise NewGalaxyClusterError(
diff --git a/tests/mispevent_testfiles/galaxy.json b/tests/mispevent_testfiles/galaxy.json
index a2d91076b..778656b53 100644
--- a/tests/mispevent_testfiles/galaxy.json
+++ b/tests/mispevent_testfiles/galaxy.json
@@ -13,7 +13,7 @@
             "description": "Milk in tea",
             "uuid": "24430dc6-9c27-4b3c-a5e7-6dda478fffa0",
             "distribution": "3",
-            "default": true,
+            "default": false,
             "meta": {
                 "kill_chain": [
                     "tea:black"
diff --git a/tests/test_galaxy_cluster.py b/tests/test_galaxy_cluster.py
new file mode 100644
index 000000000..93aa02766
--- /dev/null
+++ b/tests/test_galaxy_cluster.py
@@ -0,0 +1,18 @@
+#!/usr/bin/env python
+
+from __future__ import annotations
+
+import unittest
+
+from pymisp import MISPGalaxyCluster
+from pymisp.exceptions import NewGalaxyClusterError
+
+
+class TestMISPGalaxyCluster(unittest.TestCase):
+
+    def test_default_cluster_rejects_distribution_fields(self) -> None:
+        for field in ("distribution", "sharing_group_id"):
+            with self.subTest(field=field):
+                cluster = MISPGalaxyCluster()
+                with self.assertRaisesRegex(NewGalaxyClusterError, field):
+                    cluster.from_dict(default=True, **{field: 1})