mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
095a68b2ec
- Improve or just remove some file magic signatures ported from libmagic that were too general and matched incorrectly too often. - Fix MHR script's use of fa_file$mime_type before checking if it's initialized. It may be uninitialized if no signatures match. - The "fa_file" record now contains a "mime_types" field that contains all magic signatures that matched the file content (where the "mime_type" field is just a shortcut for the strongest match).
17 lines
453 B
Standard ML
17 lines
453 B
Standard ML
# General purpose file magic signatures.
|
|
|
|
signature file-plaintext {
|
|
file-magic /([[:print:][:space:]]+)/
|
|
file-mime "text/plain", -20
|
|
}
|
|
|
|
signature file-binary {
|
|
# Exclude bytes that can be ASCII or some ISO-8859 characters.
|
|
file-magic /(.*)([^[:print:][:space:]\xa0-\xff]+)/
|
|
file-mime "binary", -10
|
|
}
|
|
|
|
signature file-tar {
|
|
file-magic /([[:print:]\x00]){100}(([[:digit:]\x00\x20]){8}){3}/
|
|
file-mime "application/x-tar", 150
|
|
}
|