Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 13:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Improve multipart HTTP/MIME entity file analysis.

Browse source 
Singular CR or LF characters in multipart body content are no longer
converted to a full CRLF (thus corrupting the file) and it also no
longer considers the CRLF before the multipart boundary as part of the
content.

Addresses BIT-1235.
This commit is contained in:
Jon Siwek 2014-08-26 17:50:28 -05:00
parent 73cc81f44a
commit d5513a0757
13 changed files with 82 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.multipart/1-file
View file

@ -1 +1 @@
test
test

2
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.multipart/2-file
View file

@ -1 +1 @@
test2
test2

2
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.multipart/3-file
View file

@ -1 +1 @@
test3
test3

30
testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.multipart/out
View file

@ -1,39 +1,39 @@
FILE_NEW
file #0, 0, 0
FILE_BOF_BUFFER
test^M^J
test
FILE_OVER_NEW_CONNECTION
FILE_STATE_REMOVE
file #0, 6, 0
file #0, 4, 0
[orig_h=141.142.228.5, orig_p=57262/tcp, resp_h=54.243.88.146, resp_p=80/tcp]
source: HTTP
MD5: 9f06243abcb89c70e0c331c61d871fa7
SHA1: fde773a18bb29f5ed65e6f0a7aa717fd1fa485d4
SHA256: 837ccb607e312b170fac7383d7ccfd61fa5072793f19a25e75fbacb56539b86b
MD5: 098f6bcd4621d373cade4e832627b4f6
SHA1: a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA256: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
FILE_NEW
file #1, 0, 0
FILE_BOF_BUFFER
test2^M^J
test2
FILE_OVER_NEW_CONNECTION
FILE_STATE_REMOVE
file #1, 7, 0
file #1, 5, 0
[orig_h=141.142.228.5, orig_p=57262/tcp, resp_h=54.243.88.146, resp_p=80/tcp]
source: HTTP
MD5: d68af81ef370b3873d50f09140068810
SHA1: 51a7b6f2d91f6a87822dc04560f2972bc14fc97e
SHA256: de0edd0ac4a705aff70f34734e90a1d0a1d8b76abe4bb53f3ea934bc105b3b17
MD5: ad0234829205b9033196ba818f7a872b
SHA1: 109f4b3c50d7b0df729d299bc6f8e9ef9066971f
SHA256: 60303ae22b998861bce3b28f33eec1be758a213c86c93c076dbe9f558c11c752
FILE_NEW
file #2, 0, 0
FILE_BOF_BUFFER
test3^M^J
test3
FILE_OVER_NEW_CONNECTION
FILE_STATE_REMOVE
file #2, 7, 0
file #2, 5, 0
[orig_h=141.142.228.5, orig_p=57262/tcp, resp_h=54.243.88.146, resp_p=80/tcp]
source: HTTP
MD5: 1a3d75d44753ad246f0bd333cdaf08b0
SHA1: 4f98809ab09272dfcc58266e3f23ae2393f70e76
SHA256: 018c67a2c30ed9977e1dddfe98cac542165dac355cf9764c91a362613e752933
MD5: 8ad8757baa8564dc136c1e07507f4a98
SHA1: 3ebfa301dc59196f18593c45e519287a23297589
SHA256: fd61a03af4f77d870fc21e05e7e80678095c92d808cfb3b5c279ee04c74aca13
FILE_NEW
file #3, 0, 0
FILE_BOF_BUFFER