[exim] CLSID attachment blocking

Páxina inicial
Borrar esta mensaxe
Responder a esta mensaxe
Autor: Stephen Gran
Data:  
Para: exim-users
Asunto: [exim] CLSID attachment blocking
Hello all,

I have a rather simple minded request for assistance, perhaps, but it's
been bothering me.

The general advice found on google and places is to use:
regex = ^(?i)Content-Disposition::(.*?)filename=\\s*"+((\{[a-hA-H0-9-]{25,}\})|((.*?)\\s{10,}(.*?)))"+\$

(long line, sorry)

This is supposed to block files with CLSID extensions in their name.
Unfortunately, the test from testvirus.org makes it through this without
a problem, so it clearly doesn't work that well. Comparing them, I see
this:

Content-Type:  text/plain;
        name="clsidfile.txt.{00020C01-0000-0000-C000-000000000046}";
Content-Disposition: attachment;
        filename="clsidfile.txt.{00020C01-0000-0000-C000-000000000046}"


And, while I'm still not great at regex's, what I see we're looking for
in the above usual advice is:

Beginning of line, csae-insensitive match for 'Content-Disposition::' -
Content-Disposition: matches, but immediately, the second colon does
not.

Then, any amount of any character, followed by 'filename=', followed by
any amount of whitespace. This is a match.

One or more " (double-quote) followed by either:
  a 25 (or more?) character string enclosed in {}, or
  any amount of anything, followed by 10 (or more?) spaces, followed by 
    any amount of anything.


End with one or more ".

Is that correct?  If I am interpreting it correctly, it will only match
filenames that are either:
'{25+ alphanumics}', or 'anything           anything'


and then only if the Content-Disposition incorrectly contains a double
colon.

Maybe, something like:
^(?i)Content-Disposition:+(.*?)filename=\\s*"+((.*\{[a-hA-H0-9-]{25,}\})|((.*?)\\s{10,}(.*?)))"+\$

(Changes the double colon to one or more colons, and allows for anything
in front of the CLSID marker). Since I am not great at regular
expressions, I thought I'd post here first, in case I'm doing something
really stupid. I'd rather be stupid publically than be stupid when
admin'ing :)

Thanks for any comments,
--
--------------------------------------------------------------------------
|  Stephen Gran                  | BOFH excuse #298:  Not enough           |
|  steve@???             | interrupts                              |
|  http://www.lobefin.net/~steve |                                         |

--------------------------------------------------------------------------