mirror of https://github.com/MISP/mail_to_misp
exclude attachements of size 0 bytes
Optionally exclude attachments that are 0 bytes longpull/39/head
parent
b02cce7d14
commit
92c99c0559
|
@ -44,6 +44,9 @@ class Mail2MISP():
|
||||||
setattr(self.config, 'enable_dns', False)
|
setattr(self.config, 'enable_dns', False)
|
||||||
self.debug = self.config.debug
|
self.debug = self.config.debug
|
||||||
self.config_from_email_body = {}
|
self.config_from_email_body = {}
|
||||||
|
if not hasattr(self.config, 'ignore_nullsize_attachments'):
|
||||||
|
setattr(self.config, 'ignore_nullsize_attachments', False)
|
||||||
|
self.ignore_nullsize_attachments = self.config.ignore_nullsize_attachments
|
||||||
# Init Faup
|
# Init Faup
|
||||||
self.f = Faup()
|
self.f = Faup()
|
||||||
self.sightings_to_add = []
|
self.sightings_to_add = []
|
||||||
|
@ -134,6 +137,7 @@ class Mail2MISP():
|
||||||
if email_object.attachments:
|
if email_object.attachments:
|
||||||
# Create file objects for the attachments
|
# Create file objects for the attachments
|
||||||
for attachment_name, attachment in email_object.attachments:
|
for attachment_name, attachment in email_object.attachments:
|
||||||
|
if not (self.ignore_nullsize_attachments == True and attachment.getbuffer().nbytes == 0):
|
||||||
if not attachment_name:
|
if not attachment_name:
|
||||||
attachment_name = 'NameMissing.txt'
|
attachment_name = 'NameMissing.txt'
|
||||||
if self.config_from_email_body.get('attachment') == self.config.m2m_benign_attachment_keyword:
|
if self.config_from_email_body.get('attachment') == self.config.m2m_benign_attachment_keyword:
|
||||||
|
|
|
@ -19,6 +19,7 @@ nameservers = ['149.13.33.69']
|
||||||
email_subject_prefix = 'M2M'
|
email_subject_prefix = 'M2M'
|
||||||
attach_original_mail = False
|
attach_original_mail = False
|
||||||
ignore_carrier_mail = False
|
ignore_carrier_mail = False
|
||||||
|
ignore_nullsize_attachments = False
|
||||||
|
|
||||||
excludelist = ('google.com', 'microsoft.com')
|
excludelist = ('google.com', 'microsoft.com')
|
||||||
externallist = ('virustotal.com', 'malwr.com', 'hybrid-analysis.com', 'emergingthreats.net')
|
externallist = ('virustotal.com', 'malwr.com', 'hybrid-analysis.com', 'emergingthreats.net')
|
||||||
|
|
Loading…
Reference in New Issue