Fix REGEX_URL_PROTOCOL to support standard URL schemes with colons

[opbot-xd]

Description

During the refactoring of the Cowrie extraction strategy (PR #639), a bug was identified in greedybear/regex.py regarding how URL protocols are matched.

Problem

The current regex REGEX_URL_PROTOCOL uses the pattern ps?, which expects the protocol to be immediately followed by // (e.g., http//). This causes the regex to miss standard URLs that include a colon, such as http:// or https://, which are commonly found in payloads.

Proposed Solution

Update the regex pattern to optionally match the colon character by changing ps? to ps?:?.

Location

greedybear/regex.py

Example

• Current behavior: Matches http//example.com, misses http://example.com
• Expected behavior: Should match both.

Related PRs

Discovered and fixed in #639.

[regulartim]

Really good catch! This bug is in the code base since the very beginning. So it looks like the extraction that used that regex never really worked.

Expected behavior: Should match both.

Should it though? AFAIK http//example.com is not a valid URL and therefore should NOT be matched. Am I right?

[opbot-xd]

Even though http// is technically an invalid protocol format, I decided to keep matching it to ensure this remains a non-breaking change and maintains full backward compatibility, just in case any legacy logic or existing data relies on that specific behavior.

[regulartim]

Ok, that's fine!