Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 21:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Improved file name extraction for SMTP when file name is included in Content-Type header.

Browse source
This commit is contained in:
Seth Hall 2012-12-13 10:27:08 -05:00
parent 43ed437daa
commit 0cf98ac325
2 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/protocols/smtp/entities.bro
View file

@ -177,6 +177,10 @@ event mime_one_header(c: connection, h: mime_header_rec)
if ( h$name == "CONTENT-DISPOSITION" &&
/[fF][iI][lL][eE][nN][aA][mM][eE]/ in h$value )
c$smtp$current_entity$filename = extract_filename_from_content_disposition(h$value);
if ( h$name == "CONTENT-TYPE" &&
/[nN][aA][mM][eE][:blank:]*=/ in h$value )
c$smtp$current_entity$filename = extract_filename_from_content_disposition(h$value);
}
event mime_end_entity(c: connection) &priority=-5