security-and-privacy/mat2
security-and-privacy/mat2
1
0
Fork 0
mirror of synced 2024-11-25 02:34:24 +01:00
Code Releases Activity

Use of the archive refactoring for the office documents too

Browse Source
This commit is contained in:
jvoisin 2019-02-07 21:58:10 +01:00
parent b9a62d798a
commit e1dd439fc8
3 changed files with 19 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
libmat2/office.py
View File

@ -2,7 +2,7 @@ import logging
import os
import re
import zipfile
from typing import Dict, Set, Pattern, Tuple, Union, Any
from typing import Dict, Set, Pattern, Tuple, Any
import xml.etree.ElementTree as ET # type: ignore
@ -375,23 +375,17 @@ class LibreOfficeParser(ArchiveBasedAbstractParser):
return False
return True
def get_meta(self) -> Dict[str, Union[str, dict]]:
def _specific_get_meta(self, full_path: str, file_path: str) -> Dict[str, Any]:
"""
Yes, I know that parsing xml with regexp ain't pretty,
be my guest and fix it if you want.
"""
metadata = {}
zipin = zipfile.ZipFile(self.filename)
for item in zipin.infolist():
if item.filename == 'meta.xml':
if file_path != 'meta.xml':
return {}
with open(full_path, encoding='utf-8') as f:
try:
content = zipin.read(item).decode('utf-8')
results = re.findall(r"<((?:meta|dc|cp).+?)>(.+)</\1>", content, re.I|re.M)
for (key, value) in results:
metadata[key] = value
results = re.findall(r"<((?:meta|dc|cp).+?)>(.+)</\1>", f.read(), re.I|re.M)
return {k:v for (k, v) in results}
except (TypeError, UnicodeDecodeError): # We didn't manage to parse the xml file
metadata[item.filename] = 'harmful content'
for key, value in self._get_zipinfo_meta(item).items():
metadata[key] = value
zipin.close()
return metadata
# We didn't manage to parse the xml file
return {file_path: 'harmful content', }

7
tests/test_corrupted_files.py
View File

@ -67,15 +67,10 @@ class TestCorruptedEmbedded(unittest.TestCase):
os.remove('./tests/data/clean.docx')
def test_odt(self):
expected = {
'create_system': 'Weird',
'date_time': '2018-06-10 17:18:18',
'meta.xml': 'harmful content'
}
shutil.copy('./tests/data/embedded_corrupted.odt', './tests/data/clean.odt')
parser, _ = parser_factory.get_parser('./tests/data/clean.odt')
self.assertFalse(parser.remove_all())
self.assertEqual(parser.get_meta(), expected)
self.assertTrue(parser.get_meta())
os.remove('./tests/data/clean.odt')

14
tests/test_libmat2.py
View File

@ -138,14 +138,14 @@ class TestGetMeta(unittest.TestCase):
def test_libreoffice(self):
p = office.LibreOfficeParser('./tests/data/dirty.odt')
meta = p.get_meta()
self.assertEqual(meta['meta:initial-creator'], 'jvoisin ')
self.assertEqual(meta['meta:creation-date'], '2011-07-26T03:27:48')
self.assertEqual(meta['meta:generator'], 'LibreOffice/3.3$Unix LibreOffice_project/330m19$Build-202')
self.assertEqual(meta['meta.xml']['meta:initial-creator'], 'jvoisin ')
self.assertEqual(meta['meta.xml']['meta:creation-date'], '2011-07-26T03:27:48')
self.assertEqual(meta['meta.xml']['meta:generator'], 'LibreOffice/3.3$Unix LibreOffice_project/330m19$Build-202')
p = office.LibreOfficeParser('./tests/data/weird_producer.odt')
meta = p.get_meta()
self.assertEqual(meta['create_system'], 'Windows')
self.assertEqual(meta['comment'], b'YAY FOR COMMENTS')
self.assertEqual(meta['mimetype']['create_system'], 'Windows')
self.assertEqual(meta['mimetype']['comment'], b'YAY FOR COMMENTS')
def test_txt(self):
p, mimetype = parser_factory.get_parser('./tests/data/dirty.txt')
@ -440,7 +440,7 @@ class TestCleaning(unittest.TestCase):
p = office.LibreOfficeParser('./tests/data/clean.odf')
meta = p.get_meta()
self.assertEqual(meta['meta:creation-date'], '2018-04-23T00:18:59.438231281')
self.assertEqual(meta['meta.xml']['meta:creation-date'], '2018-04-23T00:18:59.438231281')
ret = p.remove_all()
self.assertTrue(ret)
@ -458,7 +458,7 @@ class TestCleaning(unittest.TestCase):
p = office.LibreOfficeParser('./tests/data/clean.odg')
meta = p.get_meta()
self.assertEqual(meta['dc:date'], '2018-04-23T00:26:59.385838550')
self.assertEqual(meta['meta.xml']['dc:date'], '2018-04-23T00:26:59.385838550')
ret = p.remove_all()
self.assertTrue(ret)