procmail
[Top] [All Lists]

Re: Help! Need to use procmail to fight dangerous security exploit

1998-07-29 11:03:48
Brett Glass gave an example,

| > Content-Disposition: attachment; filename="<verylongname>"

Christopher Lindsey suggested to Brett Glass,

|    :0
|    * ^Content-Disposition: attachment; filename=\/"<[^\<"]+>"
|    * 1^1 MATCH ?? .
|    { FILENAMELENGTH=`expr $= - 4` }
| 
| Now you can use FILENAMELENGTH to do things with the mail...
| 
|    # if FILENAMELENGTH longer than 63, dump to /var/spool/mail/danger
|    :0:
|    * FILENAMELENGTH ?? (6[4-9]|[7-9][0-9]|[1-9][0-9][0-9]+)
|    /var/spool/mail/danger

Well, first, I think that Brett's angle brackets were a way of saying that
"verylongname" represents a very long name and is not the very long name in
question; they aren't really there, as the quotes are.  Second, there's no
need for expr or comparing the length to a regexp, because procmail's scoring
can do all that.

That said, I know little of MIME and less about this newly publicized danger
(the newspaper article I read this morning mostly wafted over my head), so
I'm tweaking Christopher's code more than anything else:

  :0: # Do we need HB to check for it on every multipart piece?
  * ^Content-Disposition:(.*\>)?filename="\/[^"]+
  * 1^1 MATCH ?? .
  * -63^0
  dangerbox

Alternatively, if the goal is to truncate the filename to sixty-three
characters as I thought Brett was asking,

 :0fhw # sixty-three dots in second condition
 * ^Content-Disposition:(.*\>)?filename="\/[^"]+
 * MATCH ?? ^^\/...............................................................
 | formail -I "Content-Disposition: attachment; filename=\"$MATCH\""