zeek/testing/btest/Baseline/scripts.base.frameworks.file-analysis.http.multipart/out
Jon Siwek d5513a0757 Improve multipart HTTP/MIME entity file analysis.
Singular CR or LF characters in multipart body content are no longer
converted to a full CRLF (thus corrupting the file) and it also no
longer considers the CRLF before the multipart boundary as part of the
content.

Addresses BIT-1235.
2014-08-26 17:54:41 -05:00

51 lines
1.4 KiB
Text

FILE_NEW
file #0, 0, 0
FILE_BOF_BUFFER
test
FILE_OVER_NEW_CONNECTION
FILE_STATE_REMOVE
file #0, 4, 0
[orig_h=141.142.228.5, orig_p=57262/tcp, resp_h=54.243.88.146, resp_p=80/tcp]
source: HTTP
MD5: 098f6bcd4621d373cade4e832627b4f6
SHA1: a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA256: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
FILE_NEW
file #1, 0, 0
FILE_BOF_BUFFER
test2
FILE_OVER_NEW_CONNECTION
FILE_STATE_REMOVE
file #1, 5, 0
[orig_h=141.142.228.5, orig_p=57262/tcp, resp_h=54.243.88.146, resp_p=80/tcp]
source: HTTP
MD5: ad0234829205b9033196ba818f7a872b
SHA1: 109f4b3c50d7b0df729d299bc6f8e9ef9066971f
SHA256: 60303ae22b998861bce3b28f33eec1be758a213c86c93c076dbe9f558c11c752
FILE_NEW
file #2, 0, 0
FILE_BOF_BUFFER
test3
FILE_OVER_NEW_CONNECTION
FILE_STATE_REMOVE
file #2, 5, 0
[orig_h=141.142.228.5, orig_p=57262/tcp, resp_h=54.243.88.146, resp_p=80/tcp]
source: HTTP
MD5: 8ad8757baa8564dc136c1e07507f4a98
SHA1: 3ebfa301dc59196f18593c45e519287a23297589
SHA256: fd61a03af4f77d870fc21e05e7e80678095c92d808cfb3b5c279ee04c74aca13
FILE_NEW
file #3, 0, 0
FILE_BOF_BUFFER
{^J "data":
MIME_TYPE
text/plain
FILE_OVER_NEW_CONNECTION
FILE_STATE_REMOVE
file #3, 465, 0
[orig_h=141.142.228.5, orig_p=57262/tcp, resp_h=54.243.88.146, resp_p=80/tcp]
total bytes: 465
source: HTTP
MD5: 226244811006caf4ac904344841168dd
SHA1: 7222902b8b8e68e25c0422e7f8bdf344efeda54d
SHA256: dd485ecf240e12807516b0a27718fc3ab9a17c1158a452967343c98cefba07a0