[Mimedefang] testing file magic?

[David F. Skoll]

On Tue, 22 Jul 2003, James Ralston wrote:

> Has anyone tried using File::MMagic (or similar) to identify hazardous
> attachments?

One of my clients did that, a long while ago.

> When the filter() function is running, the extracted attachment is
> sitting somewhere in the "Work" subdirectory.  But I'm not certain how
> to fiddle with the MIME::Entity object to get to it.

See the mimedefang.pl source code and MIME::Entity man pages.

The filename is in $entity->bodyhandle->path, though you should check
that $entity->bodyhandle is defined before doing anything with it.

I don't think it's even necessary to use a fancy Perl module for
this.  If you read the body, and the first two characters are "MZ", treat
it as a DOS executable and trash it. :-)

--
David.