search

kevoreilly / CAPEv2

Malware Configuration And Payload Extraction
https://capesandbox.com/analysis/
Other
1.97k stars 420 forks source link

URL Submission not properly handling commas #2218

Open CarsonHrusovsky opened 3 months ago

CarsonHrusovsky commented 3 months ago

About accounts on capesandbox.com

This is open source and you are getting free support so be friendly!

Prerequisites

Please answer the following questions for yourself before submitting an issue.

Issue

This is a pretty simple bug. When submitting URLs for analysis, if a url contains a comma it interprets it as two separate submissions. This may be by design for allowing multiple submissions from the same command, but it doesn't work particularly well in a production environment.

image

image

I'd recommend just handling input on submission as a string.

Question Answer
Git commit commit 97eeb1cf71e3818ea24065df9a141de9b5a86f18
OS version Ubuntu 24.04
doomedraven commented 3 months ago

it does, it says URL, not urlS, you need to wrie extension to handly multiple urls

CarsonHrusovsky commented 3 months ago

So this isn't intended behavior? We have seen legitimate url submissions that contain a comma character in them, but is interpreted as two separate submissions.

doomedraven commented 3 months ago

Idk, I never submitted more that one so can't speak of that

doomedraven commented 3 months ago

ok now that i read your issue properly, yes we do split by comma in urls to split them by comma, not sure which char to use to split them properly as i see that yes that allows to use comma, any suggestion? sorry misread your issue initially

CarsonHrusovsky commented 3 months ago

no worries - can be tricky to find a good delimiting character. I'd suggest something that can't appear in normal URL, so say a space maybe? If that doesn't work for other user use case, maybe a better solution is to make multi submissions a toggle in the web GUI.

Otherwise I'd use a Latin-American character but I've no idea how this would impact other users who aren't using our character set.

doomedraven commented 3 months ago

Space is legit as is %20 if not encoded

El mar, 23 jul 2024, 15:52, CarsonHrusovsky @.***> escribió:

no worries - can be tricky to find a good delimiting character. I'd suggest something that can't appear in normal URL, so say a space maybe? If that doesn't work for other user use case, maybe a better solution is to make multi submissions a toggle in the web GUI.

Otherwise I'd use a Latin-American character but I've no idea how this would impact other users who aren't using our character set.

— Reply to this email directly, view it on GitHub https://github.com/kevoreilly/CAPEv2/issues/2218#issuecomment-2245319746, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAOFH36TMWBKHUSYS4JKORDZNZNYLAVCNFSM6AAAAABKU7PJ42VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENBVGMYTSNZUGY . You are receiving this because you commented.Message ID: @.***>

CarsonHrusovsky commented 3 months ago

hmm okay - maybe this a feature that isn't needed? Would be very easy to automate multiple submissions for users who need that - and by default just make only one submission at a time expected?

I struggle to think of a character that a user would both expect to be a separator and also have regular access to. (␛) this character for example could be used but this isn't practical.

I think the best choice is to have users who want to submit multiple URL at the same time to handle that in a script (and have a toggle in the GUI for them as well). I would be more than happy to write a script to submit multiple URL that can be kept in the /extra/ directory for manual use by users.