svn commit: r1895485 - /spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/OLEVBMacro.pm

[gb...@apache.org]

Author: gbechis
Date: Thu Dec  2 08:39:35 2021
New Revision: 1895485

URL: http://svn.apache.org/viewvc?rev=1895485&view=rev
Log:
Add a sub check_olertfobject to check if a document has
a potencially malicious rtf document embedded

Modified:
    spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/OLEVBMacro.pm

Modified: spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/OLEVBMacro.pm
URL: http://svn.apache.org/viewvc/spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/OLEVBMacro.pm?rev=1895485&r1=1895484&r2=1895485&view=diff
==============================================================================
--- spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/OLEVBMacro.pm (original)
+++ spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/OLEVBMacro.pm Thu Dec  2 08:39:35 2021
@@ -30,6 +30,9 @@ Mail::SpamAssassin::Plugin::OLEVBMacro -
     body     OLEOBJ eval:check_oleobject()
     describe OLEOBJ Attachment has an Ole Object
 
+    body     OLERTF eval:check_olertfobject()
+    describe OLERTF Attachment has an Ole Rtf Object
+
     body     OLEMACRO_MALICE eval:check_olemacro_malice()
     describe OLEMACRO_MALICE Potentially malicious Office Macro
 
@@ -131,6 +134,7 @@ sub new {
 
   $self->register_eval_rule("check_olemacro", $Mail::SpamAssassin::Conf::TYPE_BODY_EVALS);
   $self->register_eval_rule("check_oleobject", $Mail::SpamAssassin::Conf::TYPE_BODY_EVALS);
+  $self->register_eval_rule("check_olertfobject", $Mail::SpamAssassin::Conf::TYPE_BODY_EVALS);
   $self->register_eval_rule("check_olemacro_csv", $Mail::SpamAssassin::Conf::TYPE_BODY_EVALS);
   $self->register_eval_rule("check_olemacro_malice", $Mail::SpamAssassin::Conf::TYPE_BODY_EVALS);
   $self->register_eval_rule("check_olemacro_renamed", $Mail::SpamAssassin::Conf::TYPE_BODY_EVALS);
@@ -421,6 +425,14 @@ sub check_oleobject {
   return $pms->{oleobject_exists};
 }
 
+sub check_olertfobject {
+  my ($self,$pms,$body,$name) = @_;
+
+  _check_attachments(@_) unless exists $pms->{olertfobject_exists};
+
+  return $pms->{olertfobject_exists};
+}
+
 sub check_olemacro_csv {
   my ($self,$pms,$body,$name) = @_;
 
@@ -822,6 +834,7 @@ sub _check_macrotype_doc {
   );
 
   my $oledir = 'xl/embeddings/';
+  my $olertfdir = 'word/';
 
   my @members = $zip->members();
   foreach my $member (@members){
@@ -836,6 +849,11 @@ sub _check_macrotype_doc {
         $pms->{oleobject_exists} = 1;
         last;
     }
+    if ($mname =~ /^$olertfdir.{1,50}\.rtf/) {
+        dbg("Found $mname ole rtf file");
+        $pms->{olertfobject_exists} = 1;
+        last;
+    }
   }
 
   # Look for a member named [Content_Types].xml and do checks
@@ -1066,5 +1084,6 @@ sub _decode_part_header {
 
 # Version features
 sub has_olemacro_redirect_uri { 1 }
+sub has_olertfobject { 1 }
 
 1;