target / strelka

Real-time, container-based file scanning at enterprise scale
Other
857 stars 111 forks source link

Fix for Invalid Stripping for Email Message ID Parsing #427

Closed phutelmyer closed 8 months ago

phutelmyer commented 8 months ago

Describe the change This change modifies the ScanEmail class in the strelka scanner module. The update involves a minor alteration where the message_id field is extracted from the email header without the surrounding angle brackets (<>) by using .strip rather than simply the removal of the first and last character.

The message_id to be parsed out is: <DS7PR03MB5640AD212589DFB7CE58D90CFBEB9@DS7PR03MB5640.namprd03.prod.outlook.com>

Prior to fix, the message_id looked like this: "message_id": "S7PR03MB5640AD212589DFB7CE58D90CFBEB9@DS7PR03MB5640.namprd03.prod.outlook.co"

After the fix, the message_id looks like this: "message_id": "DS7PR03MB5640AD212589DFB7CE58D90CFBEB9@DS7PR03MB5640.namprd03.prod.outlook.com"

I did a bad job originally parsing it.

Describe testing procedures scan_test_email.py was modified to pass based on the change

Sample output N/A

Checklist