2019-11-27 15:53:27 +01:00
|
|
|
--[[
|
2022-03-25 21:16:35 +01:00
|
|
|
Copyright (c) 2022, Vsevolod Stakhov <vsevolod@rspamd.com>
|
2019-11-27 15:53:27 +01:00
|
|
|
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
you may not use this file except in compliance with the License.
|
|
|
|
You may obtain a copy of the License at
|
|
|
|
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
See the License for the specific language governing permissions and
|
|
|
|
limitations under the License.
|
|
|
|
]]--
|
|
|
|
|
|
|
|
local function process_pdf_specific(task, part, specific)
|
|
|
|
local suspicious_factor = 0
|
|
|
|
if specific.encrypted then
|
2020-05-22 14:02:32 +02:00
|
|
|
task:insert_result('PDF_ENCRYPTED', 1.0, part:get_filename() or 'unknown')
|
2019-11-27 15:53:27 +01:00
|
|
|
suspicious_factor = suspicious_factor + 0.1
|
|
|
|
if specific.openaction then
|
|
|
|
suspicious_factor = suspicious_factor + 0.5
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2020-01-21 13:47:42 +01:00
|
|
|
if specific.scripts then
|
2020-05-22 14:02:32 +02:00
|
|
|
task:insert_result('PDF_JAVASCRIPT', 1.0, part:get_filename() or 'unknown')
|
2020-01-21 13:47:42 +01:00
|
|
|
suspicious_factor = suspicious_factor + 0.1
|
2019-11-27 15:53:27 +01:00
|
|
|
end
|
|
|
|
|
|
|
|
if specific.suspicious then
|
2020-06-30 18:25:29 +02:00
|
|
|
suspicious_factor = suspicious_factor + specific.suspicious
|
2019-11-27 15:53:27 +01:00
|
|
|
end
|
|
|
|
|
|
|
|
if suspicious_factor > 0.5 then
|
2023-08-07 12:41:28 +02:00
|
|
|
if suspicious_factor > 1.0 then
|
|
|
|
suspicious_factor = 1.0
|
|
|
|
end
|
2020-05-22 14:02:32 +02:00
|
|
|
task:insert_result('PDF_SUSPICIOUS', suspicious_factor, part:get_filename() or 'unknown')
|
|
|
|
end
|
|
|
|
|
|
|
|
if specific.long_trailer then
|
|
|
|
task:insert_result('PDF_LONG_TRAILER', 1.0, string.format('%s:%d',
|
|
|
|
part:get_filename() or 'unknown', specific.long_trailer))
|
|
|
|
end
|
|
|
|
if specific.many_objects then
|
|
|
|
task:insert_result('PDF_MANY_OBJECTS', 1.0, string.format('%s:%d',
|
|
|
|
part:get_filename() or 'unknown', specific.many_objects))
|
2019-11-27 15:53:27 +01:00
|
|
|
end
|
2020-05-22 15:02:26 +02:00
|
|
|
if specific.timeout_processing then
|
|
|
|
task:insert_result('PDF_TIMEOUT', 1.0, string.format('%s:%.3f',
|
|
|
|
part:get_filename() or 'unknown', specific.timeout_processing))
|
|
|
|
end
|
2019-11-27 15:53:27 +01:00
|
|
|
end
|
|
|
|
|
|
|
|
local tags_processors = {
|
|
|
|
pdf = process_pdf_specific
|
|
|
|
}
|
|
|
|
|
|
|
|
local function process_specific_cb(task)
|
|
|
|
local parts = task:get_parts() or {}
|
|
|
|
|
2023-08-07 12:41:28 +02:00
|
|
|
for _, p in ipairs(parts) do
|
2019-11-27 15:53:27 +01:00
|
|
|
if p:is_specific() then
|
|
|
|
local data = p:get_specific()
|
|
|
|
|
|
|
|
if data and type(data) == 'table' and data.tag then
|
|
|
|
if tags_processors[data.tag] then
|
|
|
|
tags_processors[data.tag](task, p, data)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2023-08-07 12:41:28 +02:00
|
|
|
local id = rspamd_config:register_symbol {
|
2019-11-27 15:53:27 +01:00
|
|
|
type = 'callback',
|
|
|
|
name = 'SPECIFIC_CONTENT_CHECK',
|
|
|
|
callback = process_specific_cb
|
|
|
|
}
|
|
|
|
|
2023-08-07 12:41:28 +02:00
|
|
|
rspamd_config:register_symbol {
|
2019-11-27 15:53:27 +01:00
|
|
|
type = 'virtual',
|
|
|
|
name = 'PDF_ENCRYPTED',
|
|
|
|
parent = id,
|
2023-08-07 12:41:28 +02:00
|
|
|
groups = { "content", "pdf" },
|
2019-11-27 15:53:27 +01:00
|
|
|
}
|
2023-08-07 12:41:28 +02:00
|
|
|
rspamd_config:register_symbol {
|
2019-11-27 15:53:27 +01:00
|
|
|
type = 'virtual',
|
|
|
|
name = 'PDF_JAVASCRIPT',
|
|
|
|
parent = id,
|
2023-08-07 12:41:28 +02:00
|
|
|
groups = { "content", "pdf" },
|
2019-11-27 15:53:27 +01:00
|
|
|
}
|
2023-08-07 12:41:28 +02:00
|
|
|
rspamd_config:register_symbol {
|
2019-11-27 15:53:27 +01:00
|
|
|
type = 'virtual',
|
|
|
|
name = 'PDF_SUSPICIOUS',
|
|
|
|
parent = id,
|
2023-08-07 12:41:28 +02:00
|
|
|
groups = { "content", "pdf" },
|
2019-11-27 15:53:27 +01:00
|
|
|
}
|
2023-08-07 12:41:28 +02:00
|
|
|
rspamd_config:register_symbol {
|
2020-05-22 14:02:32 +02:00
|
|
|
type = 'virtual',
|
|
|
|
name = 'PDF_LONG_TRAILER',
|
|
|
|
parent = id,
|
2023-08-07 12:41:28 +02:00
|
|
|
groups = { "content", "pdf" },
|
2020-05-22 14:02:32 +02:00
|
|
|
}
|
2023-08-07 12:41:28 +02:00
|
|
|
rspamd_config:register_symbol {
|
2020-05-22 14:02:32 +02:00
|
|
|
type = 'virtual',
|
|
|
|
name = 'PDF_MANY_OBJECTS',
|
|
|
|
parent = id,
|
2023-08-07 12:41:28 +02:00
|
|
|
groups = { "content", "pdf" },
|
2020-05-22 14:02:32 +02:00
|
|
|
}
|
2023-08-07 12:41:28 +02:00
|
|
|
rspamd_config:register_symbol {
|
2020-05-22 15:02:26 +02:00
|
|
|
type = 'virtual',
|
|
|
|
name = 'PDF_TIMEOUT',
|
|
|
|
parent = id,
|
2023-08-07 12:41:28 +02:00
|
|
|
groups = { "content", "pdf" },
|
2023-02-17 16:11:31 +01:00
|
|
|
}
|