1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
#!/usr/bin/perl -w
sub hook_data_post {
my ($self, $transaction) = @_;
# make sure we read from the beginning;
$transaction->body_resetpos;
my $line_number = 0;
my $seen_file = 0;
my $ct_filename = '';
my $cd_filename = '';
while ($_ = $transaction->body_getline) {
last if $line_number++ > 40;
if (/^Content-Type: (.*)/) {
my $val = $1;
if ($val =~ /name="(.*)"/) {
$seen_file = 1;
$ct_filename = $1;
}
}
if (/^Content-Disposition: (.*)/) {
my $val = $1;
if ($val =~ /filename="(.*)"/) {
$seen_file = 1;
$cd_filename = $1;
}
}
}
if ($seen_file and $ct_filename and $cd_filename) {
if ($ct_filename ne $cd_filename) {
return (DENY, "Probably the 'Hi' virus");
}
}
return DECLINED;
}
|
