dockers icon indicating copy to clipboard operation
dockers copied to clipboard

Submitting a .eml/.msg File as Attachment

Open soulsf opened this issue 6 years ago • 1 comments

I'd like to submit an eml/msg File as attachment. After adding "message/rfc822" to the .conf "files:" section, I get an error when submitting an email with an attached .eml:

=== [INFO]: Found attachment: Mail-Anhang.eml (message/rfc822) Traceback (most recent call last): File "/home/so/dockers/imap2thehive/imap2thehive.py", line 252, in submitTheHive tmp.write(part.get_payload(decode=1)) TypeError: a bytes-like object is required, not 'NoneType'

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "/home/so/dockers/imap2thehive/imap2thehive.py", line 548, in main() File "/home/so/dockers/imap2thehive/imap2thehive.py", line 544, in main readMail(mailConnect()) File "/home/so/dockers/imap2thehive/imap2thehive.py", line 417, in readMail if submitTheHive(message) == True: File "/home/so/dockers/imap2thehive/imap2thehive.py", line 254, in submitTheHive except OSerror as e: NameError: name 'OSerror' is not defined

Seems like it's the same as described here:

https://www.reddit.com/r/learnpython/comments/80c3bt/extract_email_attachment_when_attachment_is_an/

soulsf avatar Feb 19 '19 16:02 soulsf

first time I ever saw python, so sorry, but this works:

....

else:
            # Extract MIME parts
            filename = part.get_filename()
            mimetype = part.get_content_type()

            # for rfc822
            if 'message/' in mimetype and filename:
                fname, fextension = os.path.splitext(filename)
                fd, path = tempfile.mkstemp(prefix=slugify(fname) + "_", suffix=fextension)
                try:
                    with open(fd, 'w') as tmp:
                        gen = email.generator.Generator(tmp)
                        gen.flatten(part.get_payload()[0])
                        attachments.append(path)
                except OSerror as e:
                    log.error("Cannot dump attachment to %s: %s" % (path,e.errno))
                    return False
            if filename and not 'message/' in mimetype:
                if mimetype in config['caseFiles'] or not config['caseFiles']:

...

But the E-Mail Text from the .eml/.msg File is used as case description, which is not nice of course.

soulsf avatar Feb 19 '19 21:02 soulsf