fmbla / spamassassin-olemacro

Detect Microsoft Office (DOC XLS etc) attachments with Macros
8 stars 6 forks source link

Cannot set olemacro regex options #1

Closed Gazoo closed 5 years ago

Gazoo commented 5 years ago

I was testing this plugin and it looks like there is a bug with any of the regex config options. The is_delimited_regexp_valid method is called and it expects the value to be wrapped in proper delimiters (which it is not). Also you can't just set the delimiters to the config lines as they are already wrapped in delimiters though out the code (so they would be double wrapped). The fix would be to just wrap them when passing them into the is_delimited_regexp_valid method.

To test just set the defaults in local.cf:

ifplugin Mail::SpamAssassin::Plugin::OLEMacro
olemacro_max_file 512000
olemacro_num_mime 5
olemacro_num_zip 5
olemacro_zip_depth 2
olemacro_extended_scan 0
olemacro_exts (?:doc|dot|pot|ppa|pps|ppt|sldm|xl|xla|xls|xlt|xslb)$
olemacro_macro_exts (?:docm|dotm|ppam|potm|ppst|ppsm|pptm|sldm|xlm|xlam|xlsb|xlsm|xltm)$
olemacro_zips (?:zip)$
olemacro_skip_exts (?:docx|dotx|potx|ppsx|pptx|sldx|xlsx|xltx)$
olemacro_skip_ctypes ^(?:(audio|image|text)\/|application\/(?:pdf))
olemacro_prefer_contentdisposition 1
endif

Restarting Spamassassin from a recent build:

Oct 27 11:14:48 el7p17 spamd[17633]: config: invalid regexp for rule TESTING: (?:doc|dot|pot|ppa|pps|ppt|sldm|xl|xla|xls|xlt|xslb)$: missing or invalid delimiters
Oct 27 11:14:48 el7p17 spamd[17633]: config: SpamAssassin failed to parse line, "(?:doc|dot|pot|ppa|pps|ppt|sldm|xl|xla|xls|xlt|xslb)$" is not valid for "olemacro_exts", skipping: olemacro_exts (?:doc|dot|pot|ppa|pps|ppt|sldm|xl|xla|xls|xlt|xslb)$
Oct 27 11:14:48 el7p17 spamd[17633]: config: invalid regexp for rule TESTING: (?:docm|dotm|ppam|potm|ppst|ppsm|pptm|sldm|xlm|xlam|xlsb|xlsm|xltm)$: missing or invalid delimiters
Oct 27 11:14:48 el7p17 spamd[17633]: config: SpamAssassin failed to parse line, "(?:docm|dotm|ppam|potm|ppst|ppsm|pptm|sldm|xlm|xlam|xlsb|xlsm|xltm)$" is not valid for "olemacro_macro_exts", skipping: olemacro_macro_exts (?:docm|dotm|ppam|potm|ppst|ppsm|pptm|sldm|xlm|xlam|xlsb|xlsm|xltm)$
Oct 27 11:14:48 el7p17 spamd[17633]: config: invalid regexp for rule TESTING: (?:zip)$: missing or invalid delimiters
Oct 27 11:14:48 el7p17 spamd[17633]: config: SpamAssassin failed to parse line, "(?:zip)$" is not valid for "olemacro_zips", skipping: olemacro_zips (?:zip)$
Oct 27 11:14:48 el7p17 spamd[17633]: config: invalid regexp for rule TESTING: (?:docx|dotx|potx|ppsx|pptx|sldx|xlsx|xltx)$: missing or invalid delimiters
Oct 27 11:14:48 el7p17 spamd[17633]: config: SpamAssassin failed to parse line, "(?:docx|dotx|potx|ppsx|pptx|sldx|xlsx|xltx)$" is not valid for "olemacro_skip_exts", skipping: olemacro_skip_exts (?:docx|dotx|potx|ppsx|pptx|sldx|xlsx|xltx)$
Oct 27 11:14:48 el7p17 spamd[17633]: config: invalid regexp for rule TESTING: ^(?:(audio|image|text)\/|application\/(?:pdf)): missing or invalid delimiters
Oct 27 11:14:48 el7p17 spamd[17633]: config: SpamAssassin failed to parse line, "^(?:(audio|image|text)\/|application\/(?:pdf))" is not valid for "olemacro_skip_ctypes", skipping: olemacro_skip_ctypes ^(?:(audio|image|text)\/|application\/(?:pdf))
Gazoo commented 5 years ago

It looks like this might have worked before but is_delimited_regexp_valid expects proper delimiters to be set. Maybe use is_regexp_valid instead?

The change: https://github.com/apache/spamassassin/commit/06fda859e58ff55f1290ed6255e1ed06d3af0e32#diff-1b0526ddeccd96eb7eaa9063434af02f

Gazoo commented 5 years ago

Here is the fix: https://gist.github.com/Gazoo/333e55d43d3425cd632e56afc9913d07

steadramon commented 5 years ago

Gazoo - thanks for the info, I'm going to test this fully with older versions of SA as well as my other plugins.

Thanks for the heads up!

steadramon commented 5 years ago

Should be resolved! Thanks again