From 546a19caab14bbce7e73eaeb5999a80bf511cac5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rapha=C3=ABl=20Vinot?= Date: Thu, 29 Aug 2019 11:16:05 +0200 Subject: [PATCH] fix: Encrypted is an indicator --- filecheck/filecheck.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/filecheck/filecheck.py b/filecheck/filecheck.py index 1fd8450..28bdb15 100644 --- a/filecheck/filecheck.py +++ b/filecheck/filecheck.py @@ -404,9 +404,6 @@ class File(FileBase): self.make_dangerous('WinOffice file containing a macro') else: indicators = oid.check() - # Encrypted can be set by multiple checks on the script - if oid.encrypted.value: - self.make_dangerous('Encrypted WinOffice file') if oid.macros.value or oid.ole.exists('macros/vba') or oid.ole.exists('Macros') \ or oid.ole.exists('_VBA_PROJECT_CUR') or oid.ole.exists('VBA'): self.make_dangerous('WinOffice file containing a macro') @@ -415,6 +412,9 @@ class File(FileBase): self.make_dangerous('WinOffice file containing an object pool') elif i.id == 'flash' and i.value: self.make_dangerous('WinOffice file with embedded flash') + elif i.id == 'encrypted' and i.value: + self.make_dangerous('Encrypted WinOffice file') + self.add_description('WinOffice file') def _ooxml(self):