Browse code

ooxml: added detection of custom properties ooxml/ole2: added detection of digital signatures

Kevin Lin authored on 2014/05/20 07:18:20
Showing 2 changed files
... ...
@@ -528,7 +528,7 @@ ole2_walk_property_tree(ole2_header_t * hdr, const char *dir, int32_t prop_index
528 528
 {
529 529
     property_t      prop_block[4];
530 530
     int32_t         idx, current_block, i, curindex;
531
-    char           *dirname;
531
+    char           *name, *dirname;
532 532
     ole2_list_t     node_list;
533 533
     int             ret, func_ret;
534 534
 
... ...
@@ -698,6 +698,18 @@ ole2_walk_property_tree(ole2_header_t * hdr, const char *dir, int32_t prop_index
698 698
         case 1:                /* Directory */
699 699
             ole2_listmsg("directory node\n");
700 700
             if (dir) {
701
+#if HAVE_JSON
702
+                if ((ctx->options & CL_SCAN_FILE_PROPERTIES) && (ctx->wrkproperty != NULL)) {
703
+                    if (json_object_object_get(ctx->wrkproperty, "DigitalSignatures") == NULL) {
704
+                        name = get_property_name2(prop_block[idx].name, prop_block[idx].name_size);
705
+                        cli_dbgmsg("[dir] %s\n", name);
706
+                        if (name && (!strcmp(name, "_xmlsignatures") || !strcmp(name, "_signatures"))) {
707
+                            cli_jsonbool(ctx->wrkproperty, "DigitalSignatures", 1);
708
+                            free(name);
709
+                        }
710
+                    }
711
+                }
712
+#endif
701 713
                 dirname = (char *)cli_malloc(strlen(dir) + 8);
702 714
                 if (!dirname) {
703 715
 		    ole2_listmsg("OLE2: malloc failed for dirname\n");
... ...
@@ -472,7 +472,7 @@ static int ooxml_extn_cb(int fd, cli_ctx *ctx)
472 472
 static int ooxml_content_cb(int fd, cli_ctx *ctx)
473 473
 {
474 474
     int ret = CL_SUCCESS;
475
-    int core=0, extn=0, cust=0;
475
+    int core=0, extn=0, cust=0, dsig=0;
476 476
     const xmlChar *name, *value, *CT, *PN;
477 477
     xmlTextReaderPtr reader = NULL;
478 478
     uint32_t loff;
... ...
@@ -542,10 +542,23 @@ static int ooxml_content_cb(int fd, cli_ctx *ctx)
542 542
             else {
543 543
                 cli_dbgmsg("ooxml_content_cb: found custom properties file \"%s\" @ %x\n", PN, loff);
544 544
                 /* custom properties ignored for now */
545
+                cli_jsonbool(ctx->wrkproperty, "CustomProperties", 1);
545 546
                 //ret = unzip_single_internal(ctx, loff, ooxml_cust_cb);
546 547
             }
547 548
             cust = 1;
548 549
         }
550
+        else if (!dsig && !xmlStrcmp(CT, "application/vnd.openxmlformats-package.digital-signature-xmlsignature+xml")) {
551
+            if (unzip_search(ctx, PN+1, xmlStrlen(PN)-1, &loff) != CL_VIRUS) {
552
+                cli_dbgmsg("cli_process_ooxml: failed to find digital signature file \"%s\"!\n", PN);
553
+            }
554
+            else {
555
+                cli_dbgmsg("ooxml_content_cb: found digital signature file \"%s\" @ %x\n", PN, loff);
556
+                /* digital signatures ignored for now */
557
+                cli_jsonbool(ctx->wrkproperty, "DigitalSignatures", 1);
558
+                //ret = unzip_single_internal(ctx, loff, ooxml_dsig_cb);
559
+            }
560
+            dsig = 1;
561
+        }
549 562
 
550 563
         if (ret != CL_SUCCESS)
551 564
             goto ooxml_content_exit;