Skip to content

Clam 2196 html style image extract #813

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Feb 8, 2023
Merged

Clam 2196 html style image extract #813

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
f40f5b7
Minor code cleanup
val-ms Dec 15, 2022
059bfc0
Find and scan base64'd images found in HTML <style> url() args
val-ms Dec 16, 2022
00c8df0
Test: verify clamscan detecting 2 images from same HTML style block
val-ms Jan 20, 2023
a4e372f
HTML <style> image extraction improvement
val-ms Jan 21, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
266 changes: 185 additions & 81 deletions libclamav/htmlnorm.c
View file
Open in desktop

Large diffs are not rendered by default.

10 changes: 7 additions & 3 deletions libclamav/htmlnorm.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@
#include "clamav-types.h"
#include "fmap.h"
#include "dconf.h"
#include "others.h"

typedef struct tag_arguments_tag {
int count;
Expand All @@ -44,10 +45,13 @@ typedef struct m_area_tag {
fmap_t *map;
} m_area_t;

int html_normalise_mem(unsigned char *in_buff, off_t in_size, const char *dirname, tag_arguments_t *hrefs, const struct cli_dconf *dconf);
int html_normalise_map(fmap_t *map, const char *dirname, tag_arguments_t *hrefs, const struct cli_dconf *dconf);
typedef void *css_image_extractor_t;
typedef void *css_image_handle_t;

bool html_normalise_mem(cli_ctx *ctx, unsigned char *in_buff, off_t in_size, const char *dirname, tag_arguments_t *hrefs, const struct cli_dconf *dconf);
bool html_normalise_map(cli_ctx *ctx, fmap_t *map, const char *dirname, tag_arguments_t *hrefs, const struct cli_dconf *dconf);
void html_tag_arg_free(tag_arguments_t *tags);
int html_screnc_decode(fmap_t *map, const char *dirname);
bool html_screnc_decode(fmap_t *map, const char *dirname);
void html_tag_arg_add(tag_arguments_t *tags, const char *tag, char *value);

#endif
8 changes: 4 additions & 4 deletions libclamav/mbox.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -217,7 +217,7 @@ static int count_quotes(const char *buf);
static bool next_is_folded_header(const text *t);
static bool newline_in_header(const char *line);

static blob *getHrefs(message *m, tag_arguments_t *hrefs);
static blob *getHrefs(cli_ctx*, message *m, tag_arguments_t *hrefs);
static void hrefs_done(blob *b, tag_arguments_t *hrefs);
static void checkURLs(message *m, mbox_ctx *mctx, mbox_status *rc, int is_html);

Expand Down Expand Up @@ -3855,7 +3855,7 @@ static void extract_text_urls(const unsigned char *mem, size_t len, tag_argument
* disabled (see ifdef)
*/
static blob *
getHrefs(message *m, tag_arguments_t *hrefs)
getHrefs(cli_ctx *ctx, message *m, tag_arguments_t *hrefs)
{
unsigned char *mem;
blob *b = messageToBlob(m, 0);
Expand Down Expand Up @@ -3884,7 +3884,7 @@ getHrefs(message *m, tag_arguments_t *hrefs)

cli_dbgmsg("getHrefs: calling html_normalise_mem\n");
mem = blobGetData(b);
if (!html_normalise_mem(mem, (off_t)len, NULL, hrefs, m->ctx->dconf)) {
if (!html_normalise_mem(ctx, mem, (off_t)len, NULL, hrefs, m->ctx->dconf)) {
blobDestroy(b);
return NULL;
}
Expand Down Expand Up @@ -3925,7 +3925,7 @@ checkURLs(message *mainMessage, mbox_ctx *mctx, mbox_status *rc, int is_html)
hrefs.tag = hrefs.value = NULL;
hrefs.contents = NULL;

b = getHrefs(mainMessage, &hrefs);
b = getHrefs(mctx->ctx, mainMessage, &hrefs);
if (b) {
if (hrefs.scanContents) {
if (phishingScan(mctx->ctx, &hrefs) == CL_VIRUS) {
Expand Down
2 changes: 1 addition & 1 deletion libclamav/scanners.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2110,7 +2110,7 @@ static cl_error_t cli_scanhtml(cli_ctx *ctx)

cli_dbgmsg("cli_scanhtml: using tempdir %s\n", tempname);

(void)html_normalise_map(map, tempname, NULL, ctx->dconf);
(void)html_normalise_map(ctx, map, tempname, NULL, ctx->dconf);

snprintf(fullname, 1024, "%s" PATHSEP "nocomment.html", tempname);
fd = open(fullname, O_RDONLY | O_BINARY);
Expand Down
2 changes: 2 additions & 0 deletions libclamav_rust/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,8 @@ image = "0.24"
rustdct = "0.7"
transpose = "0.2"
num-traits = "0.2"
base64 = "0.21.0"
sha1 = "0.10.5"

[lib]
crate-type = ["staticlib"]
Expand Down
2 changes: 1 addition & 1 deletion libclamav_rust/build.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ const BINDGEN_FUNCTIONS: &[&str] = &[
];

// Generate bindings for these types (structs, enums):
const BINDGEN_TYPES: &[&str] = &["cli_matcher", "cli_ac_data", "cli_ac_result"];
const BINDGEN_TYPES: &[&str] = &["cli_matcher", "cli_ac_data", "cli_ac_result", "css_image_extractor_t", "css_image_handle_t"];

// Find the required functions and types in these headers:
const BINDGEN_HEADERS: &[&str] = &[
Expand Down
2 changes: 1 addition & 1 deletion libclamav_rust/cbindgen.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ after_includes = "typedef struct cli_matcher cli_matcher; typedef struct cli_ctx
autogen_warning = "/* Warning, this file is autogenerated by cbindgen. Don't modify this manually. */"
header = "/* Copyright (C) 2021-2022 Cisco Systems, Inc. and/or its affiliates. All rights reserved. */"
include_guard = "__CLAMAV_RUST_H"
includes = ["clamav.h", "matcher-ac.h"]
includes = ["clamav.h", "matcher-ac.h", "htmlnorm.h"]
no_includes = false
sys_includes = []

Expand Down
Loading