Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fallback to mimetype when yara identification yielded no conclusive result #1837

Merged
merged 1 commit into from
Nov 21, 2024
Merged

Fallback to mimetype when yara identification yielded no conclusive result #1837

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion assemblyline/common/identify.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@

from assemblyline.common.digests import DEFAULT_BLOCKSIZE, get_digests_for_file
from assemblyline.common.forge import get_cachestore, get_config, get_constants, get_datastore
from assemblyline.common.identify_defaults import OLE_CLSID_GUIDs
from assemblyline.common.identify_defaults import OLE_CLSID_GUIDs, untrusted_mimes
from assemblyline.common.identify_defaults import magic_patterns as default_magic_patterns
from assemblyline.common.identify_defaults import trusted_mimes as default_trusted_mimes
from assemblyline.common.str_utils import dotdump, safe_str
Expand Down Expand Up @@ -392,6 +392,10 @@ def fileinfo(
# Only if the file was not identified as a csv or a json
data["type"] = self.yara_ident(path, data, fallback=data["type"])

if ("unknown" in data["type"] or data["type"] == "text/plain") and data["mime"] in untrusted_mimes:
# Rely on untrusted mimes
data["type"] = untrusted_mimes[data["mime"]]

# Extra checks for office documents
# - Check for encryption
if data["type"] in [
Expand Down
9 changes: 9 additions & 0 deletions assemblyline/common/identify_defaults.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -447,3 +447,12 @@
# Android
"application/vnd.android.package-archive": "android/apk",
}

# LibMagic mimetypes that we will fallback to when we can't determine a type
untrusted_mimes = {
"application/javascript": "code/javascript",
"text/x-java": "code/java",
"text/html": "code/html",
"text/x-c++": "code/c++",
"text/x-c": "code/c",
}