static void
rspamadm_confighelp_search_word_step (const ucl_object_t *obj,
ucl_object_t *res,
const gchar *str,
gsize len,
GString *path)
{
ucl_object_iter_t it = NULL;
const ucl_object_t *cur, *elt;
const gchar *dot_pos;
while ((cur = ucl_object_iterate (obj, &it, true)) != NULL) {
if (cur->keylen > 0) {
rspamd_printf_gstring (path, ".%*s", (int) cur->keylen, cur->key);
if (rspamd_substring_search_caseless (cur->key,
cur->keylen,
str,
len) != -1) {
ucl_object_insert_key (res, ucl_object_ref (cur),
path->str, path->len, true);
goto fin;
}
}
if (ucl_object_type (cur) == UCL_OBJECT) {
elt = ucl_object_lookup (cur, "data");
if (elt != NULL && ucl_object_type (elt) == UCL_STRING) {
if (rspamd_substring_search_caseless (elt->value.sv,
elt->len,
str,
len) != -1) {
ucl_object_insert_key (res, ucl_object_ref (cur),
path->str, path->len, true);
goto fin;
}
}
rspamadm_confighelp_search_word_step (cur, res, str, len, path);
}
fin:
/* Remove the last component of the path */
dot_pos = strrchr (path->str, '.');
if (dot_pos) {
g_string_erase (path, dot_pos - path->str,
path->len - (dot_pos - path->str));
}
}
}
static gboolean
rspamd_archive_cheat_detect (struct rspamd_mime_part *part, const gchar *str,
const guchar *magic_start, gsize magic_len)
{
struct rspamd_content_type *ct;
const gchar *p;
rspamd_ftok_t srch, *fname;
ct = part->ct;
RSPAMD_FTOK_ASSIGN (&srch, "application");
if (ct && ct->type.len && ct->subtype.len > 0 && rspamd_ftok_cmp (&ct->type,
&srch) == 0) {
if (rspamd_substring_search_caseless (ct->subtype.begin, ct->subtype.len,
str, strlen (str)) != -1) {
return TRUE;
}
}
if (part->cd) {
fname = &part->cd->filename;
if (fname && fname->len > strlen (str)) {
p = fname->begin + fname->len - strlen (str);
if (rspamd_lc_cmp (p, str, strlen (str)) == 0) {
if (*(p - 1) == '.') {
return TRUE;
}
}
}
if (magic_start != NULL) {
if (part->parsed_data.len > magic_len && memcmp (part->parsed_data.begin,
magic_start, magic_len) == 0) {
return TRUE;
}
}
}
return FALSE;
}
static gboolean
rspamd_archive_cheat_detect (struct rspamd_mime_part *part, const gchar *str,
const guchar *magic_start, gsize magic_len)
{
GMimeContentType *ct;
const gchar *fname, *p;
ct = part->type;
if (ct && ct->type && ct->subtype && strcmp (ct->type,
"application") == 0) {
if (rspamd_substring_search_caseless (ct->subtype, strlen (ct->subtype),
str, strlen (str)) != -1) {
return TRUE;
}
}
fname = part->filename;
if (fname && strlen (fname) > strlen (str)) {
p = fname + strlen (fname) - strlen (str);
if (rspamd_lc_cmp (p, str, strlen (str)) == 0) {
if (*(p - 1) == '.') {
return TRUE;
}
}
}
if (magic_start != NULL) {
if (part->content->len > magic_len && memcmp (part->content->data,
magic_start, magic_len) == 0) {
return TRUE;
}
}
return FALSE;
}
