search

scVENUS / PeekabooAV

Peekaboo Extended Email Attachment Behavior Observation Owl
https://peekabooav.de
GNU General Public License v3.0
66 stars 20 forks source link

Uri filenames #180

Closed michaelweiser closed 3 years ago

michaelweiser commented 3 years ago

We're seeing attachments whose declared filenames include what seems to be meant as query strings (e.g. foo.jpg?resize=600,510). Since there are no file extensions we know of containing those characters, we do not allow them. Since we cannot find any document stating that the name parameter of header Content-Type can contain URLs/URIs, we're not even attempting to go down the rabbit hole of parsing it as such to avoid the inevitable fallout from it. Instead we rather not extract any extension at all.

As a prerequisite for testing with the testsuite two independent patches fix issues in the testsuite with python 3.8 and from that an actual behavioural problem with our oletools code uncovered by a now failing test.

Jack28 commented 3 years ago

Should we add Python 3.8 to .travis.yml

michaelweiser commented 3 years ago

Should we add Python 3.8 to .travis.yml

Good idea. I've added all supposedly supported python versions, including 3.6 and 3.9 and done positive as well as negative (by reverting a testsuite fix) tests with it. I've had a look if there's a syntax for travis.yml to say "try latest release python version as well", so we don't have to update it for python 3.10 and so on but there doesn't seem to be. Building with python-nightly seems a bit excessive for our purposes. :)

Jack28 commented 3 years ago

LGTM