procmail
[Top] [All Lists]

Re: Help! Need to use procmail to fight dangerous security exploit

1998-07-29 23:53:58
David W. Tamkin wrote:

  :0: # Do we need HB to check for it on every multipart piece?
YES

  * ^Content-Disposition:(.*\>)?filename="\/[^"]+
  * 1^1 MATCH ?? .
  * -63^0
  dangerbox

  Devil's advocate questions...
    1) If there are several short headers, are their lengths
       summed up to beat 63?
    2) Even worse; if a short header and a long header both
       exist, which one will procmail match?  First, second,
       or longest

Alternatively, if the goal is to truncate the filename to
sixty-three characters as I thought Brett was asking,

 :0fhw # sixty-three dots in second condition
 * ^Content-Disposition:(.*\>)?filename="\/[^"]+
 * MATCH ?? 
^^\/...............................................................
 | formail -I "Content-Disposition: attachment; filename=\"$MATCH\""

  Since that can be in the body, I'd do it as follows.  Note
that putting in dots "the hard way" gets around my 2 previous
potential problems.

:0BH
* ^Content-Disposition:(.*\>)?filename=\
.................................................................."
{
:0f
| formail -A "X-Reject: File attachment name greater than 63
characters"

:0
junkmail
}

  Those of you who counted 66 dots, please note that I'm
allowing for quotes around the filename.  Now what about
about Unix/NT/Win95 in terms of filename lengths?  The 32-bit
Windows variants should be able to go 255 characters, and
unixes (there are Netscape/unix versions) will probably vary.

-- 
Walter Dnes <waltdnes(_at_)interlog(_dot_)com> procmail spamfilter
http://www.interlog.com/~waltdnes/spamdunk/spamdunk.htm
Why a fiscal conservative opposes Toronto 2008 OWE-lympics
http://www.interlog.com/~waltdnes/owe-lympics/owe-lympics.htm