Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Improve multipart HTTP/MIME entity file analysis.

Browse source 
Singular CR or LF characters in multipart body content are no longer
converted to a full CRLF (thus corrupting the file) and it also no
longer considers the CRLF before the multipart boundary as part of the
content.

Addresses BIT-1235.
This commit is contained in:
Jon Siwek 2014-08-26 17:50:28 -05:00
parent 73cc81f44a
commit d5513a0757
13 changed files with 82 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/analyzer/protocol/tcp/ContentLine.cc
View file

@ -32,6 +32,7 @@ void ContentLine_Analyzer::InitState()
seq_to_skip = 0;
plain_delivery_length = 0;
is_plain = 0;
suppress_weirds = false;
InitBuffer(0);
}
@ -258,7 +259,7 @@ int ContentLine_Analyzer::DoDeliverOnce(int len, const u_char* data)
else
{
if ( Conn()->FlagEvent(SINGULAR_LF) )
if ( ! suppress_weirds && Conn()->FlagEvent(SINGULAR_LF) )
Conn()->Weird("line_terminated_with_single_LF");
buf[offset++] = c;
}
@ -277,7 +278,7 @@ int ContentLine_Analyzer::DoDeliverOnce(int len, const u_char* data)
}
if ( last_char == '\r' )
if ( Conn()->FlagEvent(SINGULAR_CR) )
if ( ! suppress_weirds && Conn()->FlagEvent(SINGULAR_CR) )
Conn()->Weird("line_terminated_with_single_CR");
last_char = c;
@ -307,7 +308,7 @@ void ContentLine_Analyzer::CheckNUL()
; // Ignore it.
else
{
if ( Conn()->FlagEvent(NUL_IN_LINE) )
if ( ! suppress_weirds && Conn()->FlagEvent(NUL_IN_LINE) )
Conn()->Weird("NUL_in_line");
flag_NULs = 0;
}