search

gabriel-vasile / mimetype

A fast Golang library for media type and file extension detection, based on magic numbers
https://pkg.go.dev/github.com/gabriel-vasile/mimetype#pkg-overview
MIT License
1.65k stars 162 forks source link

.torrent file in testdata getting detected as malicious file and causing build issue. #398

Open Amit99Shah opened 1 year ago

gabriel-vasile commented 1 year ago

@Amit99Shah what's the name of the tool that reports .torrent as malicious?

gabriel-vasile commented 1 year ago

.torrent files are not inherently malicious; the testdata torrent.torrent is just downloading an Arch linux iso.

I will gladly fix this problem if the tool that you are using did some thoroughly checks and found malicious intent inside that file. But if it only looked at the extension and deemed it malicious, then I don't think there's anything to fix.

FurmanovD commented 1 year ago

@gabriel-vasile it's a common practice to avoid any potential legal issues. In my case, it's FortiClient I also faced this issue because playground/validator has got a dependency on your module. And I was forced to just downgrade the validator.

gabriel-vasile commented 1 year ago

To me, this seems a gross approach from FortiClient. That being said, I understand how this argument can drag for too long so I'm willing to take steps forward once the problem is clear.

@FurmanovD, @Amit99Shah and anyone else having similar problems, your answers are greatly appreciated.

  1. Is it only .torrent that causes problems?
  2. Does renaming the file .torrent -> .nottorrent silence those "security" tools?
  3. If answer to 2. was no, does encoding the file (zip, base64, etc.) fix the error?
  4. What exactly is the reported problem? Is it security or legal related?
Amit99Shah commented 1 year ago

@gabriel-vasile Yes, renaming the file will solve this issue