MISP / MISP/misp-modules

Email Import returns Invalid file upload. -- due to issues parsing URLs that are base64 or quopri encoded

Open
#120 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
377
Forks
280
Avg merge
2d 2h
Merged PRs (30d)
10

Description

In trying to upload an EML for parsing which had a base64 encoded body, MISP returned "Invalid file upload." The cause is that we had URL parsing enabled and it only looks for HTML parts to parse not base64 or quopri. Please see about adjusting the code to look for these conditions as well.

Example:

Current code: if (extract_urls is True and part.get_content_type() == 'text/html'):

Future code:

for part in message.walk():
	decoded_part = part.get_payload()
	if part.__getitem__("Content-Transfer-Encoding") == "quoted-printable":
		decoded_part = quote_printable_decode(part)	
	elif part.__getitem__("Content-Transfer-Encoding") == "base64":
		decoded_part = base64_decode(part.get_payload())	
	if part.get_content_subtype() == "plain":
		all_urls.extend(get_urls_from_plain(decoded_part))	
	elif part.get_content_subtype() == "html":
		all_urls.extend(get_urls_from_html(decoded_part))

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the email-import code containing extract_urls, message.walk(), and the text/html condition. Reproduce the supplied EML case and trace how each part's content-transfer encoding is handled. Done means URL extraction works for base64 and quoted-printable plain or HTML parts without returning "Invalid file upload."

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.