EmlParser - fallback to hash-based name for unsafe attachment filenames

Author: nusantara-self

analyzers/EmlParser/parse.py

@@ -168,7 +168,11 @@ def artifacts(self, raw):
                             tags=["body:attachment", "autoImport:true"] + h["tag"],
                         )
                     )
-                filepath = os.path.join(self.job_directory, "output", os.path.basename(h.get("filename", "")))
+                filepath = os.path.join(
+                    self.job_directory,
+                    "output",
+                    _attachment_output_name(h.get("filename", ""), h.get("hash")),
+                )
                 file_key = ("file", filepath)
                 if file_key not in seen:
                     seen.add(file_key)
@@ -194,14 +198,23 @@ def _add_ioc(ioc_list, data, tags):
 
 
 def _safe_attachment_filename(raw_name):
+    """Reduce an attachment name to a safe basename, or None if unusable."""
     if not raw_name or "\x00" in raw_name:
-        raise ValueError("invalid attachment filename")
-    base = os.path.basename(raw_name)
+        return None
+    # normalise Windows separators first; "\" is not a separator on POSIX
+    base = os.path.basename(raw_name.replace("\\", "/"))
     if not base or base in (".", "..") or os.path.isabs(base) or re.match(r"^[A-Za-z]:", base):
-        raise ValueError("invalid attachment filename")
+        return None
     return base
 
 
+def _attachment_output_name(raw_name, sha256):
+    """On-disk basename for an attachment, falling back to its hash."""
+    return _safe_attachment_filename(raw_name) or "attachment_{}".format(
+        (sha256 or "unknown")[:16]
+    )
+
+
 def parseEml(filepath, job_directory, wkhtmltoimage, sanitized_rendering):
     ep = eml_parser.EmlParser(include_raw_body=True, include_attachment_data=True)
     with open(filepath, "rb") as f:
@@ -331,7 +344,9 @@ def parseEml(filepath, job_directory, wkhtmltoimage, sanitized_rendering):
         for a in decoded_email.get("attachment"):
             a["mime"] = magic.from_buffer(binascii.a2b_base64(a.get("raw")))
             if isinstance(a.get("raw"), bytes):
-                filename = _safe_attachment_filename(a.get("filename", ""))
+                filename = _attachment_output_name(
+                    a.get("filename", ""), (a.get("hash") or {}).get("sha256")
+                )
                 out_dir = os.path.join(job_directory, "output")
                 filepath = os.path.join(out_dir, filename)
                 if not os.path.realpath(filepath).startswith(