[Bug][EMLParser] incomplete headers

[nicodeff]

Hello,

For few eml, the analyzer EMLParser display incomplete headers.
The headers interrupt in the "DKIM-Signature" part.

Last Line of headers part in the analyzer :

Headers :

Work environment

• Client OS: Windows
• Server OS: CentOS
• Browse type and version: Chrome 89
• Cortex version: 3.1.1-1
• Cortex Analyzer/Responder name: EMLParser
• Cortex Analyzer/Responder version: Last Version

Regards,

[nicodeff]

Hello, I have Additional Information.

For all eml with partial informations, the displayed headers stop to field "h=" in "DKIM-Signature".

Regards,

[nicodeff]

Hello,

Do, you have informations about this bug ?

Thanks,

Regards,

[ch0wm3in]

This pull request fixes it #962
For some reason at some point someone introduced a 'content-type:' split into the EMLparser analyser on the header extractions even though it only extracts the headers and nothing else, at the very least even tough its unnecessary it should be an .rindex to the get the last index of 'content-type:'

I made the pull request a while ago, but noone wants to merge it :(

[jeromeleonard]

a new version of the analyzer is coming. It has been almost completely rewritten and should fix this issue.

[nicodeff]

Hello,

Sorry for this late response.
Thanks @jeromeleonard for this informations. I waiting the new version of this analyzer with impatiently. 🙏

Regards,

[nicodeff]

Hello @jeromeleonard.

I just tried to update all analyzer ans Responder Cortex via this method :

cd path/to/Cortex-Analyzers
git pull
for I in analyzers/*/requirements.txt; do sudo -H pip3 install -U -r $I || true; done
for I in responders/*/requirements.txt; do sudo -H pip3 install -U -r $I || true; done

After reload in cortex EmlParser 2.0, I have this error message :

Do you have any idea for resolve this problem ?

The python package eml_parser is already at the latest version.

Thanks,

Regards,

Nicolas

[nicodeff]

Hello,

On this git it is indicated to update Python.
GOVCERT-LU/eml_parser#53

So I switched to version 3.9.6 and my problem has been solved.
Thank you so much,

By the way, this new version of the EmlParser analyzer is great 😃
Thanks @jeromeleonard

Regards,

Nicolas