exclude attachements of size 0 bytes

Optionally exclude attachments that are 0 bytes long

mail2misp/mail2misp.py

@@ -44,6 +44,9 @@ class Mail2MISP():
             setattr(self.config, 'enable_dns', False)
         self.debug = self.config.debug
         self.config_from_email_body = {}
+        if not hasattr(self.config, 'ignore_nullsize_attachments'):
+            setattr(self.config, 'ignore_nullsize_attachments', False)
+        self.ignore_nullsize_attachments = self.config.ignore_nullsize_attachments
         # Init Faup
         self.f = Faup()
         self.sightings_to_add = []
@@ -134,6 +137,7 @@ class Mail2MISP():
         if email_object.attachments:
             # Create file objects for the attachments
             for attachment_name, attachment in email_object.attachments:
+                if not (self.ignore_nullsize_attachments == True and attachment.getbuffer().nbytes == 0):
                     if not attachment_name:
                         attachment_name = 'NameMissing.txt'
                     if self.config_from_email_body.get('attachment') == self.config.m2m_benign_attachment_keyword:

mail_to_misp_config.py-example

@@ -19,6 +19,7 @@ nameservers = ['149.13.33.69']
 email_subject_prefix = 'M2M'
 attach_original_mail = False
 ignore_carrier_mail = False
+ignore_nullsize_attachments = False
 
 excludelist = ('google.com', 'microsoft.com')
 externallist = ('virustotal.com', 'malwr.com', 'hybrid-analysis.com', 'emergingthreats.net')