Git Product home page Git Product logo

haraka-plugin-attachment's Introduction

attachment

Build Status Code Climate NPM

This plugin allows you to reject messages based on Content-Type within the message or any MIME parts or on the filename of any attachments.

Limitations

This plugin cannot detect forged MIME types where the sender is lying about the type. The type is not confirmed in any way currently.

Encrypted archives that contain encrypted sub-archives cannot be expanded and will cause the plugin to reject the message.

Requirements

To check filenames inside archive files the npm module tmp is required and the bsdtar binary must be available.

If either tmp or bsdtar are unavailable then the plugin will not expand archives.

Logging

At INFO level logging this plugin will output the filename and type of each attached file along with an MD5 checksum of the contents. The MD5 checksum is useful to check against www.virustotal.com

Configuration

  • attachment.ini

    • default settings shown

    • timeout=30

      Timeout in seconds before the plugin will abort.

    • disallowed_extensions=exe,com,pif,bat,scr,vbs,cmd,cpl,dll

      File extensions that should be rejected when detected.

      [archive]

    • max_depth=5

      The maximum level of nested archives that will be unpacked. If this is exceeded the message will be rejected.

      [archive]

    • extensions=zip,tar,tgz,taz,z,gz,rar,7z

      File extensions that should be treated as archives. This can be any file type supported by bsdtar.

  • attachment.filename.regex

    This file contains a list of regular expressions, one per line that will be tested against each filename found within a message. The first regexp to match will cause the message to be rejected. Any invalid regexps will be detected, reported and skipped.

  • attachment.archive.filename.regex

    This file contains a list of regular expressions, one per line that will be tested against each filename found within an archive file. The first regexp to match will cause the message to be rejected. Any invalid regexps will be detected, reported and skipped.

  • attachment.ctype.regex

    This file contains a list of regular expressions, one per line that will be tested against each MIME Content-Type header in the message. The first regexp to match will cause the message to be rejected. Any invalid regexps will be detected, reported and skipped.

haraka-plugin-attachment's People

Contributors

greenkeeper[bot] avatar lnedry avatar msimerson avatar snyk-bot avatar

Stargazers

avatar avatar

Watchers

avatar avatar avatar avatar avatar avatar

Forkers

isabella232 schettino donfanning rakhithjk seanpm2001

haraka-plugin-attachment's Issues

attachment: modernize & standardize

  • populate [files] in package.json. Delete .npmignore.
  • automated code linting. #3308
    • dep: eslint-plugin-haraka -> @haraka/eslint-config
    • update 'lint' script in package.json
    • verify 'lint' CI test config
  • lint: remove duplicate / stale rules from .eslintrc
  • automated code formatting (see also #3308)
  • automated CI testing.
    • mostly done, verify that local copy of ci.yml is up-to-date.
  • CONTRIBUTORS: see 3309
  • consistent naming of "special" files like CHANGELOG.md.
  • CHANGELOG: verify links at bottom (due to inconsistent tag naming)
    • latest .release does this, fixes most, and warns of errors it can't fix
  • verify GitHub repo About link points to npm package
  • convert test suites to mocha "style"
    • works great today and with node --test in v18+

Recursive issue which leads to crash

I am currently investigating problem with attachment.js files listing. Our customer tried to send tgzed attachment which contained almost whole /var/log folder from some custom linux based machine. Attachment consists of lot of text files, folders and a lot of .gz files.

From logs what I understand this happens:

  1. listing files in depth 1 with bsdtar -tf ...
  2. extracting multiple .gz files to tmps with bsdtar -Oxf ... --include ...gz
  3. listing bsdtar -tf /tmp/... fails for whatever reason (I think bsdtar can't list inside .gz files actually) and calls cb
    ... since cb is called haraka continues to another plugins
  4. but since recursive listing is in for loop another bsdtar -tf /tmp/... is called and again cb is called
  5. and we are in mess now, attachment.js generated fd's are closing, another plugins continues in same time
  6. [CRIT] [-] [core] Error: EBADF: bad file descriptor, close
  7. [NOTICE] [-] [core] Shutting down

Sadly I can't attach file - full of private informations. Can't replicate either - I think file must have structure and size to hit this issue and start race condition. Also I am not sure how to fix this issue without ditch whole plugin structure and handle recursivness in different way

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.