MISP
/
mail_to_misp
mirror of https://github.com/MISP/mail_to_misp
2
0
Fork 0
Code Issues Releases Wiki Activity

fix: Mail body can be empty...

tests
Raphaël Vinot 2018-05-07 18:22:14 +02:00
parent d9de8f7344
commit dd0d127f8c
1 changed files with 14 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
mail_to_misp.py
View File

@ -123,20 +123,22 @@ class Mail2MISP():
return email_object return email_object
def process_email_body(self): def process_email_body(self):
self.clean_email_body = html.unescape(self.original_mail.get_body().get_payload(decode=True).decode()) mail_as_bytes = self.original_mail.get_body().get_payload(decode=True)
# Check if there are config lines in the body & convert them to a python dictionary: if mail_as_bytes:
# <config.body_config_prefix>:<key>:<value> => {<key>: <value>} self.clean_email_body = html.unescape(mail_as_bytes.decode())
self.config_from_email_body = {k: v for k, v in re.findall(f'{config.body_config_prefix}:(.*):(.*)', self.clean_email_body)} # Check if there are config lines in the body & convert them to a python dictionary:
if self.config_from_email_body: # <config.body_config_prefix>:<key>:<value> => {<key>: <value>}
# ... remove the config lines from the body self.config_from_email_body = {k: v for k, v in re.findall(f'{config.body_config_prefix}:(.*):(.*)', self.clean_email_body)}
self.clean_email_body = re.sub(rf'^{config.body_config_prefix}.*\n?', '', if self.config_from_email_body:
html.unescape(self.original_mail.get_body().get_payload(decode=True).decode()), flags=re.MULTILINE) # ... remove the config lines from the body
self.clean_email_body = re.sub(rf'^{config.body_config_prefix}.*\n?', '',
html.unescape(self.original_mail.get_body().get_payload(decode=True).decode()), flags=re.MULTILINE)
# Check if autopublish key is present and valid # Check if autopublish key is present and valid
if self.config_from_email_body.get('m2mkey') == self.config.m2m_key: if self.config_from_email_body.get('m2mkey') == self.config.m2m_key:
self.misp_event.publish() self.misp_event.publish()
self._find_inline_forward() self._find_inline_forward()
self._find_attached_forward() self._find_attached_forward()
def process_body_iocs(self, email_object=None): def process_body_iocs(self, email_object=None):