fix: block distribution fields on default galaxy clusters

pymisp/mispevent.py

@@ -1442,7 +1442,7 @@ def from_dict(self, **kwargs: Any) -> None:
         self.default = kwargs.pop('default', False)
         # If the default field is set, we shouldn't have distribution or sharing group ID set
         if self.default:
-            blocked_fields = ["distribution" "sharing_group_id"]
+            blocked_fields = ["distribution", "sharing_group_id"]
             for field in blocked_fields:
                 if kwargs.get(field, None):
                     raise NewGalaxyClusterError(

tests/mispevent_testfiles/galaxy.json

@@ -13,7 +13,7 @@
             "description": "Milk in tea",
             "uuid": "24430dc6-9c27-4b3c-a5e7-6dda478fffa0",
             "distribution": "3",
-            "default": true,
+            "default": false,
             "meta": {
                 "kill_chain": [
                     "tea:black"

tests/test_galaxy_cluster.py

@@ -0,0 +1,18 @@
+#!/usr/bin/env python
+
+from __future__ import annotations
+
+import unittest
+
+from pymisp import MISPGalaxyCluster
+from pymisp.exceptions import NewGalaxyClusterError
+
+
+class TestMISPGalaxyCluster(unittest.TestCase):
+
+    def test_default_cluster_rejects_distribution_fields(self) -> None:
+        for field in ("distribution", "sharing_group_id"):
+            with self.subTest(field=field):
+                cluster = MISPGalaxyCluster()
+                with self.assertRaisesRegex(NewGalaxyClusterError, field):
+                    cluster.from_dict(default=True, **{field: 1})