Skip to content

Commit 805694b

Browse files
GiooDevGiooDev
committed
Merge branch 'cherry-pick-041f2632-2' into 'master_8.0.x'
CP V8.0 - Bug #14965: Properly handle 'Compressed file is too big to be processed' with scan-avast script. Bug #14965: Properly handle 'Compressed file is too big to be processed' with scan-avast script. * Check if mandatory SCAN_PARAMS are correctly set * Fix wrong return code if there is only 'Compressed file is too big to be processed' in first scan * Get expected return code during too big loop scan (ignore too big and decompression bomb) * Better handling reasons and statuses during scan See merge request vitam/vitam!10698 (cherry picked from commit 041f263) 38995ca Bug #14965: Properly handle 'Compressed file is too big to be processed' with scan-avast script. Co-authored-by: Julien Georges <julien.georges@culture.gouv.fr> See merge request vitam/vitam!10704
2 parents 0fba76b + 01e1aae commit 805694b

File tree

1 file changed

+70
-36
lines changed

1 file changed

+70
-36
lines changed

‎deployment/environments/antivirus/scan-avast.sh‎

Lines changed: 70 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -32,23 +32,39 @@ custom_scan () {
3232
local FILE_TO_SCAN="$1"
3333

3434
declare -A ignored_list
35-
declare -A rejected_list
3635
declare -A too_big_files
36+
declare -A rejected_list
3737
declare -A virus_detections
3838

39+
# Check if $SCAN_PARAMS contains the 'J' parameter (for JSON output)
40+
if [[ "$SCAN_PARAMS" != *J* ]]; then
41+
echo "ERROR: SCAN_PARAMS must contain the 'J' parameter for JSON output." |& tee -a ${WORKING_DIR}/scan.log
42+
REASON="Scan not performed, wrong parameter for scan command !"
43+
return $RET_FAILURE
44+
fi
45+
3946
scan $SCAN_PARAMS "$FILE_TO_SCAN" &>> ${WORKING_DIR}/scan.log
40-
local ret_code=$?
4147
# The exit status is 0 if no infected files are found and 1 otherwise.
4248
# If an error occurred, the exit status is 2.
4349
# Infected status takes precedence over error status, thus a scan where some file could not be scanned and some infection was found returns 1.
44-
45-
# Properly handle REASON without -J param
46-
if [[ $ret_code -eq 2 ]]; then
47-
REASON="Rejected files found !"
48-
elif [[ $ret_code -eq 1 ]]; then
49-
REASON="Virus found !"
50-
ret_code=$(($ret_code+1)) # Increase the return code to fit the expected Vitam's scan code
51-
fi
50+
case $? in
51+
0)
52+
REASON="No virus found."
53+
ret_code=$RET_OK
54+
;;
55+
1)
56+
REASON="Virus found !"
57+
ret_code=$RET_VIRUS_FOUND_NOTFIXED # Set to fit the expected Vitam's scan code
58+
;;
59+
2)
60+
REASON="Rejected files found !"
61+
ret_code=$RET_VIRUS_FOUND_FIXED # Temporary set ret_code as fixed to allow custom analysis (we need to determine if the rejected files are too big or ignored patterns)
62+
;;
63+
*)
64+
REASON="Scan not performed, unknown error !"
65+
ret_code=$RET_FAILURE
66+
;;
67+
esac
5268

5369
# Analyse JSON logs from scan
5470
while read -r line; do
@@ -57,6 +73,22 @@ custom_scan () {
5773

5874
path=$(jq -r 'if .path[1] then .path[1] else .path[0] end // empty' <<< "$line")
5975

76+
# Handle warnings with classification
77+
warning_str=$(jq -r '.warning_str // empty' <<< "$line")
78+
if [[ -n "$path" && -n "$warning_str" ]]; then
79+
if [[ -n "$IGNORED_PATTERN" && "$warning_str" =~ $IGNORED_PATTERN ]]; then
80+
# First we catch the ignored patterns
81+
ignored_list["$path"]="$warning_str"
82+
elif [[ "$warning_str" == "Compressed file is too big to be processed" ]]; then
83+
# Then we catch the too big files for individual scan (if not already ignored)
84+
too_big_files["$path"]="$warning_str"
85+
else
86+
# Otherwise, it's a rejected pattern
87+
rejected_list["$path"]="$warning_str"
88+
ret_code=$RET_VIRUS_FOUND_NOTFIXED
89+
fi
90+
fi
91+
6092
# Handle virus detections
6193
if jq -e '.virus? // empty' <<< "$line" > /dev/null; then
6294
# Without -i parameter to the SCAN_PARAMS, the searched field is .virus
@@ -69,24 +101,12 @@ custom_scan () {
69101
fi
70102
if [[ -n "$path" && -n "$virus" ]]; then
71103
virus_detections["$path"]="$virus"
72-
fi
73-
74-
# Handle warnings with classification
75-
warning_str=$(jq -r '.warning_str // empty' <<< "$line")
76-
if [[ -n "$path" && -n "$warning_str" ]]; then
77-
if [[ "$warning_str" == "Compressed file is too big to be processed" ]]; then
78-
too_big_files["$path"]="$warning_str"
79-
elif [[ -n "$IGNORED_PATTERN" && "$warning_str" =~ $IGNORED_PATTERN ]]; then
80-
ignored_list["$path"]="$warning_str"
81-
else
82-
rejected_list["$path"]="$warning_str"
83-
fi
104+
ret_code=$RET_VIRUS_FOUND_NOTFIXED
84105
fi
85106
done < "${WORKING_DIR}/scan.log"
86107

87108
# --- Print summaries ---
88109
if (( ${#ignored_list[@]} > 0 )); then
89-
ret_code=$RET_VIRUS_FOUND_FIXED
90110
REASON="${#ignored_list[@]} warnings found but ignored."
91111
echo "INFO: ${REASON}" |& tee -a ${WORKING_DIR}/scan.log
92112
for path in "${!ignored_list[@]}"; do
@@ -95,7 +115,6 @@ custom_scan () {
95115
fi
96116

97117
if (( ${#rejected_list[@]} > 0 )); then
98-
ret_code=$RET_VIRUS_FOUND_NOTFIXED
99118
REASON="${#rejected_list[@]} rejected files found !"
100119
echo "ERROR: ${REASON}" |& tee -a ${WORKING_DIR}/scan.log
101120
for path in "${!rejected_list[@]}"; do
@@ -104,7 +123,6 @@ custom_scan () {
104123
fi
105124

106125
if (( ${#virus_detections[@]} > 0 )); then
107-
ret_code=$RET_VIRUS_FOUND_NOTFIXED
108126
REASON="${#virus_detections[@]} Virus found !"
109127
echo "ERROR: $REASON" |& tee -a ${WORKING_DIR}/scan.log
110128
for path in "${!virus_detections[@]}"; do
@@ -113,15 +131,16 @@ custom_scan () {
113131
fi
114132

115133
# Do not loop over big files if there are already detected errors
116-
if [[ $ret_code -ne $RET_VIRUS_FOUND_NOTFIXED ]]; then
134+
if [[ $ret_code -ne $RET_VIRUS_FOUND_NOTFIXED && $ret_code -ne $RET_FAILURE ]]; then
117135
if (( ${#too_big_files[@]} > 0 )); then
136+
REASON="No virus found in too big file."
118137
echo "INFO: ${#too_big_files[@]} files could not be processed due to size." |& tee -a ${WORKING_DIR}/scan.log
119138
echo "INFO: Starting individual scan..." |& tee -a ${WORKING_DIR}/scan.log
120139
for path in "${!too_big_files[@]}"; do
121140
unzip_and_scan "$FILE_TO_SCAN" "$path"
122-
# Exit loop if rc != 0
123-
if [ $? -ne 0 ]; then
124-
ret_code=$RET_VIRUS_FOUND_NOTFIXED
141+
ret_code=$?
142+
# Exit loop if virus found or impossible to extract
143+
if [[ $ret_code -eq $RET_VIRUS_FOUND_NOTFIXED || $ret_code -eq $RET_FAILURE ]]; then
125144
break
126145
fi
127146
done
@@ -152,21 +171,33 @@ unzip_and_scan () {
152171
tar xvjf "$ARCHIVE" --directory "$TMP_FILE" |& tee -a ${WORKING_DIR}/scan.log #uncompress the entire archive
153172
else
154173
echo "ERROR: $ARCHIVE: mime-type $TYPE_SIP is not supported" |& tee -a ${WORKING_DIR}/scan.log
174+
REASON="Unsupported big file type !"
155175
return $RET_FAILURE
156176
fi
157177

158178
# Normal scan...
159179
scan $SCAN_PARAMS "$TMP_FILE" &>> ${WORKING_DIR}/scan.log
160-
local RET=$? # return code of scan
180+
local ret_scan=$? # return code of scan
161181

162182
rm -f "$TMP_FILE"
163183

164-
if [ $RET != $RET_OK ]; then
165-
REASON="Virus found !"
184+
if [ $ret_scan -eq 1 ]; then
185+
REASON="Virus found in too big file !"
166186
return $RET_VIRUS_FOUND_NOTFIXED
187+
elif [ $ret_scan -eq 2 ]; then
188+
# Read the last line from the scan log
189+
last_line=$(tail -n 1 "${WORKING_DIR}/scan.log")
190+
if echo "$last_line" | grep -q -E "The file is a decompression bomb|Compressed file is too big to be processed"; then
191+
REASON="Ignored pattern found in too big file !"
192+
return $RET_VIRUS_FOUND_FIXED
193+
else
194+
REASON="Rejected pattern found in too big file !"
195+
return $RET_VIRUS_FOUND_NOTFIXED
196+
fi
167197
fi
168198

169-
return $RET
199+
# Otherwise, return OK
200+
return $RET_OK
170201
}
171202

172203
################################################################################
@@ -194,8 +225,9 @@ else # one argument, let's go
194225
echo "DEBUG: SIP_size: $FILE_SIZE; SIP_format: $TYPE_SIP; sha256sum: $FILE_SUM" |& tee -a ${WORKING_DIR}/scan.log
195226

196227
if grep -Fxq "$FILE_SUM" /etc/avast/whitelist; then
197-
echo "File whitelisted, escape scanning..." |& tee -a ${WORKING_DIR}/scan.log
198-
RET=0
228+
REASON="File whitelisted, escape scanning..."
229+
echo "INFO: $REASON" |& tee -a ${WORKING_DIR}/scan.log
230+
RET=$RET_VIRUS_FOUND_FIXED
199231
else
200232
custom_scan "$SIP"
201233
RET=$? # return code of scan
@@ -210,7 +242,9 @@ else # one argument, let's go
210242
elif [ $RET == $RET_VIRUS_FOUND_NOTFIXED ]; then
211243
RET_MSG="[KO: $REASON]"
212244
elif [ $RET == $RET_FAILURE ]; then
213-
RET_MSG="[ERROR: Scan not performed.]"
245+
RET_MSG="[ERROR: $REASON]"
246+
else
247+
RET_MSG="[ERROR: Unknown return code !]"
214248
fi
215249

216250
END_TIME=$(date +%s)

0 commit comments

Comments
 (0)