MISP
/
PyMISP
mirror of https://github.com/MISP/PyMISP
2
0
Fork 0
Code Issues Releases Wiki Activity

fix: Properly convert MSG to EML

pull/850/head
Raphaël Vinot 2022-07-21 16:30:40 +02:00
parent bd0e5e6b00
commit b251d70164
1 changed files with 5 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
pymisp/tools/emailobject.py
View File

@ -6,11 +6,10 @@ import logging
import ipaddress import ipaddress
import email.utils import email.utils
from email import policy, message_from_bytes from email import policy, message_from_bytes
from email.utils import parsedate_to_datetime
from email.message import EmailMessage from email.message import EmailMessage
from io import BytesIO from io import BytesIO
from pathlib import Path from pathlib import Path
from typing import Union, List, Tuple, Dict, cast from typing import Union, List, Tuple, Dict, cast, Any
from extract_msg import openMsg from extract_msg import openMsg
from extract_msg.message import Message as MsgObj from extract_msg.message import Message as MsgObj
@ -101,13 +100,9 @@ class EMailObject(AbstractMISPObjectGenerator):
eml = self._build_eml(message, body, attachments) eml = self._build_eml(message, body, attachments)
return eml return eml
def _extract_msg_objects(self, msg_obj: MsgObj): def _extract_msg_objects(self, msg_obj: MsgObj) -> Tuple[EmailMessage, Dict, List[Any]]:
"""Extracts email objects needed to construct an eml from a msg.""" """Extracts email objects needed to construct an eml from a msg."""
original_eml_header = msg_obj._getStringStream('__substg1.0_007D') message: EmailMessage = email.message_from_string(msg_obj.header.as_string(), policy=policy.default) # type: ignore
if original_eml_header:
message = email.message_from_string(original_eml_header, policy=policy.default)
else:
message = None
body = {} body = {}
if msg_obj.body is not None: if msg_obj.body is not None:
body['text'] = {"obj": msg_obj.body, body['text'] = {"obj": msg_obj.body,
@ -279,9 +274,8 @@ class EMailObject(AbstractMISPObjectGenerator):
if headers: if headers:
self.add_attribute("header", "\n".join(headers)) self.add_attribute("header", "\n".join(headers))
if "Date" in message: if "Date" in message and message.get('date').datetime is not None:
self.add_attribute("send-date", self.add_attribute("send-date", message.get('date').datetime)
parsedate_to_datetime(message.get('date')))
if "To" in message: if "To" in message:
self.__add_emails("to", message["To"]) self.__add_emails("to", message["To"])