From xxx@example.com  Thu Aug  3 07:32:10 2000
Return-Path: <xxx@example.com>
Received: from example.com (root@example.com [149.144.245.5])
	by example.com (8.9.3/8.9.3) with ESMTP id HAA01305
	for <bre@example.com>; Thu, 3 Aug 2000 07:32:03 GMT
From: xxx@example.com
Date: Thu, 3 Aug 2000 06:39:59 GMT
Message-Id: <200008030639.GAA23780@example.com>
MIME-Version: 1.0
Sender: xxx@example.com
Subject: Testing version 1.58
To: fake@example.com
Content-Type: multipart/mixed; boundary="=ABACAB:=_0006@@UtD0uere5ZCIrVlOp0vV"
X-Sanitizer: This message has been sanitized!
X-Sanitizer-URL: http://mailtools.anomy.net/


--=ABACAB:=_0006@@UtD0uere5ZCIrVlOp0vV
Content-Type: text/html; charset="iso-8859-1"
Content-Disposition: attachment
Content-Transfer-Encoding: 8bit

<html>This file has no name, but is HTML.</html>

--=ABACAB:=_0006@@UtD0uere5ZCIrVlOp0vV
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Content-Disposition: inline

****
NOTE:  An attachment was deleted from this part of the message,
because it failed one or more checks by the virus scanning system.
See the attached sanitization log for more details or contact your
system administrator.

The removed attachment's name was:

	evil.exe (evaluated as evil.exe)

It might be a good idea to contact the sender and warn them that
their system is infected.
****
--=ABACAB:=_0006@@UtD0uere5ZCIrVlOp0vV--

This should get appended as postamble

--=ABACAB:=_0006@@UtD0uere5ZCIrVlOp0vV
Content-Type: text/plain; charset="iso-8859-1"; format=flowed
Content-Disposition: attachment
Content-Transfer-Encoding: quoted-printable

This file has no name, but is text.
Here's my QP test.  =20
#!/bin/sh
echo DEFANGED.100
exit
#!/bin/sh
[ "$1" =3D "-h" ] && cat <=
<tac

This example tests the features/changes added for release 1.58:

   - Better parsing of broken MIME headers.
   - The feat_force_name exemption for text/html parts.
   - The format=3Dflowed Eudora fix.
   - The QuotedPrintable encoding/decoding cache.
   - Detecting stuff even after the multipart/* end-of-data marker

tac

# Test data: =E1=E9=ED=F3=FA=FD =FE=E6=F6=F0 =C1=C9=CD=D3=DA=DD =DE=C6=D6=
=D0
export PERL5LIB=3D"$PERL5LIB:$ANOMY/bin"
QPDATA=3D$(cat sanitizer.rev1_58.t \
  |perl -MMIME::QuotedPrint -Mbytes -npe '$_=3Dencode_qp($_);s/-/=3D2D/g')

$ANOMY/bin/sanitizer.pl -nofprot $SAN_CONF \
    'file_list_rules =3D 1' \
    'file_list_1_scanner =3D 0' \
    'file_list_1_policy =3D drop' \
    'file_list_1 =3D .exe$' \
    'file_default_policy =3D accept' \
    'file_default_filename =3D unknown.000' \
    'file_name_tpl =3D ./.tmp.$$$' \
    'header_rev =3D 0' \
    'feat_testing =3D 1' \
    'feat_force_name =3D 1' \
    'feat_log_inline =3D 1' \
    'feat_log_stderr =3D 0' <<EOF 2>test.log >test.out
From xxx@example.com  Thu Aug  3 07:32:10 2000
Return=2DPath: <xxx@example.com>
Received: from example.com (root@example.com [149.144.245.5])
	by example.com (8.9.3/8.9.3) with ESMTP id HAA01305
	for <bre@example.com>; Thu, 3 Aug 2000 07:32:03 GMT
From: xxx@example.com
Date: Thu, 3 Aug 2000 06:39:59 GMT
Message=2DId: <200008030639.GAA23780@example.com>
MIME=2DVersion: 1.0
Sender: xxx@example.com
Subject: Testing version 1.58
To: fake@example.com
Content-Type: multipart/mixed; boundary=3D"=3DABACAB:=3D_0006@@UtD0uere5ZCI=
rVlOp0vV"

=2D=2D=3DABACAB:=3D_0006@@UtD0uere5ZCIrVlOp0vV
Content=2DType: text/html; charset=3D"iso=2D8859=2D1"
Content=2DDisposition: attachment
Content=2DTransfer=2DEncoding: 8bit

<html>This file has no name, but is HTML.</html>

=2D=2D=3DABACAB:=3D_0006@@UtD0uere5ZCIrVlOp0vV=2D=2D
Content=2DType: application/octet=2Dstream;
charset=3D"evil"
Content=2DDisposition: attachment; filename=3D"evil.exe"
Content=2DTransfer=2DEncoding: 8bit

this is a very evil file.

=2D=2D=3DABACAB:=3D_0006@@UtD0uere5ZCIrVlOp0vV=2D=2D

This should get appended as postamble

=2D=2D=3DABACAB:=3D_0006@@UtD0uere5ZCIrVlOp0vV
Content=2DType: text/plain; charset=3D"iso=2D8859=2D1"; format=3Dflowed
Content=2DDisposition: attachment
Content=2DTransfer=2DEncoding: quoted=2Dprintable

This file has no name, but is text.
Here's my QP test.  =3D20
$QPDATA

=2D=2D=3DABACAB:=3D_0006@@UtD0uere5ZCIrVlOp0vV
Content=2DType: application/foobar; charset=3D"iso=2D8859=2D1"
Content=2DDisposition: attachment
Content=2DTransfer=2DEncoding: 8bit

This file has no name, but is binary.

=2D=2D=3DABACAB:=3D_0006@@UtD0uere5ZCIrVlOp0vV=2D=2D
EOF

echo "*** Exit code was $? ***" >>test.out
exit 0

--=ABACAB:=_0006@@UtD0uere5ZCIrVlOp0vV
Content-Type: application/foobar; charset="iso-8859-1"; name="unknown.000"
Content-Transfer-Encoding: 8bit
Content-Disposition: attachment

This file has no name, but is binary.

--=ABACAB:=_0006@@UtD0uere5ZCIrVlOp0vV
Content-Type: text/sanitizer-log; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
Content-Disposition: attachment; filename="sanitizer.log"

This message has been 'sanitized'.  This means that potentially
dangerous content has been rewritten or removed.  The following
log describes which actions were taken.

Sanitizer (start="0"):
  Part (pos="563"):
    SanitizeFile (filename="unnamed.html, filetype.html", mimetype="text/html"):
      Match (rule="default"):
        Enforced policy: accept

  Part (pos="765"):
    SanitizeFile (filename="evil.exe", mimetype="application/octet-stream"):
      Match (names="evil.exe", rule="1"):
        Enforced policy: drop

      Replaced mime type with: text/plain
      Replaced file name with: DEFANGED-99.txt

  Part (pos="1053"):
    SanitizeFile (filename="unnamed.txt", mimetype="text/plain"):
      Match (rule="default"):
        Enforced policy: accept

    Defanged UNIX shell script(s).

  Part (pos="4075"):
    SanitizeFile (filename="unknown.000", mimetype="application/foobar"):
      No attachment name found, using default (unknown.000).
      Match (rule="default"):
        Enforced policy: accept

  Total modifications so far: 3



--=ABACAB:=_0006@@UtD0uere5ZCIrVlOp0vV--
*** Exit code was 0 ***
