PDF attachment converting to Base64 plain text

General eFa discussion
Post Reply
mattch
Posts: 34
Joined: 28 Mar 2018 22:26

PDF attachment converting to Base64 plain text

Post by mattch » 02 Mar 2021 21:44

some PDF attachment received is converted to Base64 plain text in the email body. It happen only from one person, pdf attachment from everywhere else come in fine and attached.

Any pointers where to look as to why they coming in plain text? :romance-heartbeating:

email body

--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


---250551898-1560-1614715292=268
Content-Type: APPLICATION/pdf; NAME=?ISO-8859-1?Q?Statement_-_Lake_837.pdf?=
Content-Transfer-Encoding: BASE64

(removed data -- the document is here if i copy paste into a base64-to-pdf program)

---250551898-1560-1614715292=268--

Image

edit forgot to add, the same email is also sent to my gmail and is ok there.

mattch
Posts: 34
Joined: 28 Mar 2018 22:26

Re: PDF attachment converting to Base64 plain text

Post by mattch » 05 Mar 2021 01:55

Is there any log file i can try to glean some more info on how the attachment is handled?


i dont know if this is a bug, or how to even test but i think it has something to do with the file name of the said pdf attachment having a "/" in the actual file name. Not shown above. I dont know how to test this theory bc well, i idk how to add a / to file name to send.

in the plain text encoding i find a forward slash in the name part. i didnt catch it when i cleaned up the first post.

Code: Select all

---250551898-1560-1614715292=268
Content-Type: APPLICATION/pdf; NAME=?ISO-8859-1?Q?MY/Statement_-_Lake_837.pdf?=
Content-Transfer-Encoding: BASE64 

I also notice some anomaly in the screen shot above, the partialMessage.bin attachment
On these messages the MIME Type is in all caps "TEXT/PLAIN" and "APPLICATION/pdf".
On good messages its all lower case. "text/plain" "application/pdf". idk is relevant or not.

User avatar
shawniverson
Posts: 3398
Joined: 13 Jan 2014 23:30
Location: Indianapolis, Indiana USA
Contact:

Re: PDF attachment converting to Base64 plain text

Post by shawniverson » 07 Mar 2021 12:59

The slash in the filename is interesting. I would not be surprised if it is causing a problem.

To test this I am going to try to construct a filename with a slash in it and see what happens.

mattch
Posts: 34
Joined: 28 Mar 2018 22:26

Re: PDF attachment converting to Base64 plain text

Post by mattch » 24 Mar 2021 19:47

just following up with update and looking for any ideas.

i made file with backslash and confirm it doesn't like it. I cant figure out forward slash like in the original attachment but have a theory, maybe the forward slash is unicode \u002f. I tried contacting them but is big company and wont let me the customer talk to IT department.

I searched and found mailscanner has some ability to rename files with rules. (learning) I think
i thought if i can make a rule to fix up blackslash test, then i can -try- the same rule and try search unicode forward slash looking character.

i come up with this but i dont think im doing it correctly.
in /etc/MailScanner/filename.rules.conf
rename to File_$1_$3_$4 ^(.*)(\\)(.*)(\.text)
also tried
rename to _ \\
examples:

Code: Select all

rename to .ppt    \.pps$    Renamed pps to ppt    Renamed file
rename to Dangerous_$1_$2    ^(.*)\.(exe|com|scr)$    Renamed dangerous exes   Renamed file
test with backslash:

Code: Select all

--1268592695-1616609901=:24113
Content-ID: <20210324141821.24113.1@ubu21-1>
Content-Type: application/octet-stream; name=test-file\with-a-slash.text
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename=test-file\with-a-slash.text

--1268592695-1616609901=:24113--
gmail/ms exchange accept these and just remove the slashes.



When using the new "rename" instruction in a rule, any matching file
will be automatically renamed using the new "Rename Pattern" setting in
MailScanner.conf. This allows you to add a prefix or a suffix to any
filename.

When using the new "rename to" instruction in a rule, any matching file
will be automatically renamed so that the portion of the filename that
matches the pattern string is replaced with new text. So for example,
you can rename all *.pps files to *.ppt with the rule

rename to .ppt \.pps$ Renamed pps to ppt Renamed file

If you want to be even cleverer, you can use parenthesised sections of
the match pattern within the replacement text. I'm not quite sure who
this will be useful to, but I'm sure you will find some clever uses (you
folks always do!). As a random example,

rename to Dangerous_$1_$2 ^(.*)\.(exe|com|scr)$ Renamed dangerous
exes Renamed file

That will rename any file such as "PleaseRunMe.exe" to
"Dangerous_PleaseRunMe_exe" and rename "DodgyScreensaver.scr" to
"Dangerous_DodgyScreensaver_scr" which means the user cannot run it
without renaming it first.

mattch
Posts: 34
Joined: 28 Mar 2018 22:26

Re: PDF attachment converting to Base64 plain text

Post by mattch » 25 Mar 2021 00:22

i cant seem to get any "rename to" rules working, even basic one. "rename" works which uses default mailscanner.conf setting (.disarmed)

rename attachment with .test to .new

Code: Select all

rename to  .new \.test$

Code: Select all

rename to  .new \.test$   -   -

Post Reply