OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
header check for '.com' blocks non-exec with url in file name

From: Voytek Eymont (listssbt.net.au)
Date: Wed Feb 25 2009 - 16:59:19 CST

I have a header check meant to discard '.com' executables as follows [1]:

however, undesired operation was just reported[2]:

is there a way to 'improve' the expression to only block file names ending
in .com, how ?

or is there a better solution ?

[1]# grep hc2 *
header_checks:/^Content-(Disposition|Type):\s+.+?(file)?name="?.+?\.com(\.\S{2,4})?(\?=)?"?(;|$)/
      REJECT hc2 ".com" file attachment types not allowed

[2]# grep hc2 /var/log/maillog

Feb 25 15:45:41 bilby postfix/cleanup[15987]: B6C3EB446F3: reject: header
Content-Type:
video/x-ms-wmv;??name="CrissAngelpullsaLadyinHalfbothhalvesAlivefromwww.metacafe.com.wmv"
from nschwmtas06p.mx.bigpond.com[61.9.189.152]; from=<lawrenceyyy.com>
to=<peterxxxx.com.au> proto=ESMTP helo=<nschwmtas06p.mx.bigpond.com>:
5.7.1 hc2 ".com" file attachment types not allowed

--
Voytek