haraka / haraka-plugin-attachment

Haraka Plugin for Attachment Filtering
https://www.npmjs.com/package/haraka-plugin-attachment
MIT License
2 stars 5 forks source link

Recursive issue which leads to crash #29

Closed analogic closed 2 years ago

analogic commented 2 years ago

I am currently investigating problem with attachment.js files listing. Our customer tried to send tgzed attachment which contained almost whole /var/log folder from some custom linux based machine. Attachment consists of lot of text files, folders and a lot of .gz files.

From logs what I understand this happens:

  1. listing files in depth 1 with bsdtar -tf ...
  2. extracting multiple .gz files to tmps with bsdtar -Oxf ... --include ...gz
  3. listing bsdtar -tf /tmp/... fails for whatever reason (I think bsdtar can't list inside .gz files actually) and calls cb ... since cb is called haraka continues to another plugins
  4. but since recursive listing is in for loop another bsdtar -tf /tmp/... is called and again cb is called
  5. and we are in mess now, attachment.js generated fd's are closing, another plugins continues in same time
  6. [CRIT] [-] [core] Error: EBADF: bad file descriptor, close
  7. [NOTICE] [-] [core] Shutting down

Sadly I can't attach file - full of private informations. Can't replicate either - I think file must have structure and size to hit this issue and start race condition. Also I am not sure how to fix this issue without ditch whole plugin structure and handle recursivness in different way