Leveraging Safelist about assemblyline-service-extract HOT 4 CLOSED

To be honest, I didn't even know Extract had whitelisting methods in it's code for special cases, this could be a configurable flag like you suggested: use_custom_safelisting: true (default)

from assemblyline-service-extract.

In a first step, jar_whitelisting function could be under the control of a service parameter (check_whitelist, default:true) , so that an analyst could force the extraction of whatever checks in this long list of exceptions.
The building of the safelist could also be performed by a "clean for the moment" automated collector, with or without human vetting

from assemblyline-service-extract.

Well I'm thinking of the leveraging the AL safelist on all extract methods to avoid appending files that are known to be safe, this will support the triage-focused use-case.

However, if an analyst wants to know the complete unfiltered results from Extract (or the rest of the system), I think this is where a deep_scan flag could come into play and disable safelisting.

from assemblyline-service-extract.

I don't understand why you keep the whitelisting code just above [270-272] as those files could be check against the safelist also. I understand it lowers the number of files to handle, but the system may miss hidden stuff in an image.

from assemblyline-service-extract.