CIRCL
/
PyCIRCLean
mirror of https://github.com/CIRCL/PyCIRCLean
2
0
Fork 0
Code Issues Releases Wiki Activity

Slightly refactor File.check()

pull/21/head
Dan Puttick 2017-07-25 14:32:40 -04:00
parent 60bd5362c1
commit c87f483015
1 changed files with 39 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
bin/filecheck.py
View File

@ -165,14 +165,6 @@ class File(FileBase):
def __repr__(self):
return "<filecheck.File object: {{{}}}>".format(self.filename)
def _check_dangerous(self):
if not self.has_mimetype:
self.make_dangerous('File has no mimetype')
if not self.has_extension:
self.make_dangerous('File has no extension')
if self.extension in Config.malicious_exts:
self.make_dangerous('Extension identifies file as potentially dangerous')
def _check_extension(self):
"""
Guess the file's mimetype based on its extension.
@ -182,6 +174,9 @@ class File(FileBase):
mimetype based on its extension differs from the mimetype determined
by libmagic, then mark the file as dangerous.
"""
if not self.has_extension:
self.make_dangerous('File has no extension')
else:
if self.extension in Config.override_ext:
expected_mimetype = Config.override_ext[self.extension]
else:
@ -200,6 +195,9 @@ class File(FileBase):
Determine whether the extension that are normally associated with
the mimetype include the file's actual extension.
"""
if not self.has_mimetype:
self.make_dangerous('File has no mimetype')
else:
if self.mimetype in Config.aliases:
mimetype = Config.aliases[self.mimetype]
else:
@ -222,7 +220,7 @@ class File(FileBase):
'.Trashes', '._.Trashes', '.DS_Store', '.fseventsd', '.Spotlight-V100'
)
if self.filename in macos_hidden_files:
self.add_description('MacOS hidden metadata file.')
self.add_description('MacOS metadata file, added by MacOS to certain USB drives and directories')
self.should_copy = False
right_to_left_override = u"\u202E"
if right_to_left_override in self.filename:
@ -230,27 +228,30 @@ class File(FileBase):
new_filename = self.filename.replace(right_to_left_override, '')
self.set_property('filename', new_filename)
def _check_malicious_exts(self):
"""Check that the file's extension isn't contained in a blacklist"""
if self.extension in Config.malicious_exts:
self.make_dangerous('Extension identifies file as potentially dangerous')
def check(self):
"""
Main file processing method
Main file processing method.
Delegates to various helper methods including filetype-specific checks.
First, checks for basic properties that might indicate a dangerous file.
If the file isn't dangerous, then delegates to various helper methods
for filetype-specific checks based on the file's mimetype.
"""
if self.maintype in Config.ignored_mimes:
self.should_copy = False
else:
self._check_dangerous()
self._check_filename()
if self.has_extension:
self._check_extension()
if self.has_mimetype:
# Any of these methods can call make_dangerous():
self._check_malicious_exts()
self._check_mimetype()
self._check_extension()
self._check_filename() # can mutate self.filename
if not self.is_dangerous:
self.mime_processing_options.get(self.maintype, self.unknown)()
def write_log(self):
"""Pass information about the file to self.logger"""
"""Pass information about the file to self.logger."""
if self.logger:
props = self.get_all_props()
if not self.is_archive: