USArmyResearchLab / Dshell

Dshell is a network forensic analysis framework.
Other
5.45k stars 1.14k forks source link

Rip-http decoder crashing #56

Closed volkjohn closed 9 years ago

volkjohn commented 9 years ago

When trying to extract some files from an HTTP stream, I get the following error:

WARNING:rip-http:local variable 'contenttype' referenced before assignment
Traceback (most recent call last):
  File "~/Dshell/bin/decode", line 960, in <module>
    main(*sys.argv[1:])
  File "~/Dshell/bin/decode", line 916, in main
    decoder.cleanConnectionStore()
  File "~/Dshell/lib/dshell.py", line 337, in cleanConnectionStore
    self.close(conn)
  File "~/Dshell/lib/dshell.py", line 306, in close
    self.blobHandler(conn, conn.blobs[-1])
  File "~/Dshell/lib/httpdecoder.py", line 62, in blobHandler
    1], response=None, requesttime=self.requests[conn][0], responsetime=blob.starttime)
  File "~/Dshell/decoders/http/rip-http.py", line 82, in HTTPHandler
    contenttype, filename, data = self.POSTHandler(request.body)
  File "~/Dshell/decoders/http/rip-http.py", line 77, in POSTHandler
    return contenttype, filename, l
UnboundLocalError: local variable 'contenttype' referenced before assignment

Upon some further digging, it seems that if it is thought the request has the content that would like to be extracted, then request.body is passed to POSTHandler(). The problem lies in POSTHandler() trying to extract the content-type header from the body. Dpkt has already extracted it and placed content-type in request.headers. From what I see, POSTHandler() is no longer necessary and can share the same parsing code that is used for extracting the file from response.