Skip to content

False-positives for the msi detection #162

@fazouane-marouane

Description

@fazouane-marouane

Issuehunt badges

Hello

It seems that doc files (in fact all files that are CFB based, meaning: msi, doc, xls, ppt, oft...) are recognized as "msi" files.
Example of a doc file: http://www.softdoteducation.com/upload/study-notes/STNOTES_DOC_5.doc

Checking the code, I found the following:

	if (check([0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1])) {
		return {
			ext: 'msi',
			mime: 'application/x-msi'
		};
	}

The issue here is that 0xD0, 0xCF, 0x11, 0xE0, 0xA1, 0xB1, 0x1A, 0xE1 is the header signature for CFB format not msi specifically. https://msdn.microsoft.com/en-us/library/dd941946.aspx

Can we please remove this entry and discuss other ways of recognizing such files?
Thanks


IssueHunt Summary

hugodf hugodf has been rewarded.

Backers (Total: $40.00)

Submitted pull Requests


Tips


IssueHunt has been backed by the following sponsors. Become a sponsor

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions