public inbox for pmg-devel@lists.proxmox.com
 help / color / mirror / Atom feed
From: Stoiko Ivanov <s.ivanov@proxmox.com>
To: Friedrich Weber <f.weber@proxmox.com>
Cc: pmg-devel@lists.proxmox.com
Subject: Re: [pmg-devel] [PATCH pmg-api v2 2/2] ruledb: content-type: add flag for matching only based on magic/content
Date: Wed, 19 Feb 2025 13:22:15 +0100	[thread overview]
Message-ID: <Z7XM99cpDqek_1vf@rosa.proxmox.com> (raw)
In-Reply-To: <ab5bd9b1-cb08-4b77-8e1b-64eab07ac191@proxmox.com>

On Tue, Feb 18, 2025 at 06:18:13PM +0100, Friedrich Weber wrote:
> On 18/02/2025 14:54, Stoiko Ivanov wrote:
> > our current content-type matching is sensibly quite cautious in
> > matching if any available information indicates a potential match:
> > * mime-type detection based on file contents
> > * mime-type detection based on file suffix
> > * content-type header
> > 
> > Sometimes this can lead to surprises (e.g. when a MUA sets the
> > filetype of a pdf to application/octet-stream (the default type if no
> > information is available), or a filter for zip-files matching
> > docx-files.
> > 
> > This change gives users the option to restrict matching only on the
> > content as detected by xdg_mime_get_mime_type_for_data.
> > 
> > This is a fix for the intial request in #2691 and addresses the
> > suggestion from Friedrich from:
> > https://bugzilla.proxmox.com/show_bug.cgi?id=5618#c2
> 
> 
> Thanks for tackling this! I think having a flag like only-content makes
> sense.
> 
> I tested this a bit and there seems to be one issue, steps to reproduce:
> 
> - add a What object with a Content Type Filter for application/pdf,
> enable the new "Ignore header information" flag
> 
> - create a rule that blocks incoming mails matching this What object
> 
> - send an email with a random 1K blob as attachment that sets
> Content-Type: application/pdf and some non-descriptive filename for the
> attachment:
> 
> swaks --from [...] --to [...] --server [...] --attach-type
> application/pdf --attach-name foo.bin --attach <(dd if=/dev/urandom
> bs=1k count=1)
> 
> The email is blocked by the rule. But I would expect it to be accepted,
> because the `xdg_mime_get_mime_type_for_data` shouldn't recognize the
> random blob as PDF, and the user-provided Content-Type application/pdf
> should be ignored.
> 
> I think the email is accepted because the magic ct [1] defaults to the
> user-provided Content-Type and since `xdg_mime_get_mime_type_for_data`
> returns application/octet-stream, we're keep it at the user-provided
> Content-Type. I guess it would be nicer if the magic wouldn't default to
> the user-provided Content-Type if "Ignore header information" is
> enabled, but I'm not sure how easily this can be done.
> 
> [1]
> https://git.proxmox.com/?p=pmg-api.git;a=blob;f=src/PMG/Utils.pm;h=0b8945f245;hb=6bbc222#l623

Thanks big-time for the testing, issue-finding and analysis of the cause!
reworked the content-type finding in Utils.pm - after quickly checking
where we rely on that information:
https://lore.proxmox.com/pmg-devel/20250219121851.110090-1-s.ivanov@proxmox.com/T/#t



>..snip..


_______________________________________________
pmg-devel mailing list
pmg-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pmg-devel


  reply	other threads:[~2025-02-19 12:22 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-02-18 13:54 [pmg-devel] [PATCH pmg-api/pmg-gui v2] content-type filter: add content-only option Stoiko Ivanov
2025-02-18 13:54 ` [pmg-devel] [PATCH pmg-api v2 1/2] ruledb: disclaimer: simplify update-case Stoiko Ivanov
2025-02-18 13:54 ` [pmg-devel] [PATCH pmg-api v2 2/2] ruledb: content-type: add flag for matching only based on magic/content Stoiko Ivanov
2025-02-18 17:18   ` Friedrich Weber
2025-02-19 12:22     ` Stoiko Ivanov [this message]
2025-02-18 13:54 ` [pmg-devel] [PATCH pmg-gui v2 1/2] rules/object: remove icon from remove button Stoiko Ivanov
2025-02-18 13:54 ` [pmg-devel] [PATCH pmg-gui v2 2/2] rules/content-typefilter: add checkbox for file content only matching Stoiko Ivanov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Z7XM99cpDqek_1vf@rosa.proxmox.com \
    --to=s.ivanov@proxmox.com \
    --cc=f.weber@proxmox.com \
    --cc=pmg-devel@lists.proxmox.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Service provided by Proxmox Server Solutions GmbH | Privacy | Legal