Hello all.
Few corrections to Rick's zip_policy.pl
1. Extension analysis must be case-independent. .EXE is not much better than .exe
*** 74,80 ****
# USER SETTINGS:
# Regular expression of files not permitted in ZIP:
! my $filelist = '\.(exe|com|vb[se]|dll|ocx|pi|cmd|bat|pif?|lnk|hlp|ms[ip]|reg|sct|inf';
$filelist .= '|asd|cab|sh[sb]|scr|cpl|chm|ws[fhc]|hta|vcd|swf|vcf|eml|nws';
$filelist .= '|mim|uue?|b64|b[hq]x|xxe)';
--- 74,80 ----
# USER SETTINGS:
# Regular expression of files not permitted in ZIP:
! my $filelist =
'(?i)\.(exe|com|vb[se]|dll|ocx|pi|cmd|bat|pif?|lnk|hlp|ms[ip]|reg|sct|inf';
$filelist .= '|asd|cab|sh[sb]|scr|cpl|chm|ws[fhc]|hta|vcd|swf|vcf|eml|nws';
$filelist .= '|mim|uue?|b64|b[hq]x|xxe)';
***************
2. /usr/bin/perl seems to be more universal default than /usr/local/bin/perl
*** 1,4 ****
! #!/usr/local/bin/perl
#
# zip_policy.pl 0.01
#
--- 1,4 ----
! #!/usr/bin/perl
#
# zip_policy.pl 0.01
#
3. ($zip->eocdOffset() does not work in Archive::Zip 1.39, Debian 3.02. Should we
define exact Archive::Zip version?
*** 162,173 ****
# Abort if this is a multi-disk zip:
die "Multi-volume zip file. Cannot process.\n" if
$zip->diskNumberWithStartOfCentralDirectory();
- # Warn about file weirdness: (not certain this works as advertised)
- if ($zip->eocdOffset())
- {
- warn "Zip file offset doesn't match file! Possibly altered.\n";
- }
-
# Tally total files matching regexp:
$disallowed += $zip->membersMatching( $filelist );
Thank you for good tools!
Alexey
Rick Johnson wrote:
> Derrick Webber wrote:
>
>
>>We've posted "zip_policy.pl" to our web site. It's a small extension for
>>Anomy Sanitizer that examines ZIP attachments for banned file
>>extensions, encrypted content and other potential nastiness.
>
>
> Thanks! In the past, we were using uvscan (can't open password protected
> ZIPs) which meant that we were prone to receiving the encrypted ZIP
> files sent by bagel.x - and had to enable a ClamAV milter solution
> (ClamAV can detect these). While I won't be ditching that solution or
> Sanitizer, I can add this script to ensure that the ZIP files that may
> pass through ClamAV are properly dealt with.
>
> -Rick