Comments (2)
I identified cases where this recursion was happening by looking at file.depth:15
(default limit). The frequency is extremely low (0.00003%). The attached file, a VIM macro, triggers this bug.
from strelka.
Analyzing a large volume of events, it's apparent the mime type matching for text/html
is overly zealous.
html_file
: 1.05
text/html
: 1.6
both: 1
I see two solutions:
-
Remove the
text/html
mime type from the defaultScanHtml
configuration.While analyzing the data on this problem, it seems most of what
text/html
catches, buthtml_file
does not is either not HTML or is broken HTML (from split or partial responses). Some exceptions are things like HTML files that start with white space or comments, which can be addressed by improving thehtml_file
Yara. -
Prevent
ScanHtml
from being a child (source) of itself.This will prevent the recursion problem, and may be applicable in some other situations if implemented as a configuration. Some scanners should normally recurse. However, it won't prevent mostly unhelpful analysis of files that will not yield interesting results.
e.g.
'ScanHtml':
- positive:
flavors:
- 'hta_file'
- 'text/html'
- 'html_file'
exclude_sources:
- ScanHtml
priority: 5
options:
parser: "html5lib"
The attached file triggers the javascript variety of this bug.
from strelka.
Related Issues (20)
- [REQUEST] Add in File Counter to ScanOneNote HOT 1
- [REQUEST] New Yara rules and auto-update HOT 6
- [BUG] ScanNf Segmentation Fault HOT 1
- [BUG] Strelka UI not showing submissions HOT 10
- [BUG] Step4b of the installation isn't working HOT 5
- [BUG] Container build failing - Kinetic eol HOT 1
- [REQUEST] Make Filestream Client Requests With No Logging Asynchronous
- [REQUEST] Allow Strelka Clients to do Global Hash-Based De-duplication HOT 1
- [BUG] ScanIso Failing to Extract Some ISOs HOT 1
- [BUG] Strelka OCR Scanner not extracting all relevant text
- [BUG] ScanQR Type Assertions HOT 1
- [BUG] ScanYara - Traceback Error HOT 18
- [BUG] Login failed when UI is under port 443 HOT 2
- [BUG] Failed to serialize event HOT 1
- [BUG] New Strelka Version Fails to build on M1 Apple Silicon HOT 3
- [BUG] Login Failed with Default Credentials HOT 5
- [BUG] ScanPe adds dictionary to flags array HOT 1
- [REQUEST] How to update strelka? HOT 5
- [BUG] ScanRar Emits Exception on Password-Protected Archives HOT 1
- [BUG] VirusTotal API Error HOT 16
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from strelka.