Decoding of payload of attachment

[spamscope]

Decoding of payload of attachment

[fedelemantuano]

Hi @ad-m,

in mail-parser results there is a binary flag. If it's true the sample is a binary, else it's false is not binary.
If you read this part of code you can see:

...
charset = p.get_content_charset('utf-8') # get the charset
...

            if filename:
                    binary = False
                    mail_content_type = ported_string(p.get_content_type())
                    transfer_encoding = ported_string(
                        p.get('content-transfer-encoding', '')).lower()

                    if transfer_encoding == "base64" or \
                            (transfer_encoding == "quoted-printable" and
                             "application" in mail_content_type):
                        payload = p.get_payload(decode=False)
                        binary = True
                    else:
                        payload = ported_string(
                            p.get_payload(decode=True), encoding=charset)

mail-parser gives you the correct payload, so you should do:

            if binary:
                with open(sample, "wb") as f:
                    f.write(payload.decode("base64"))
            else:
                with open(sample, "w") as f:
                    f.write(payload.encode("utf-8"))

That's it

[fedelemantuano]

I added the store attachments function in mail-parser command line:

$ mailparser -f my_mail -sa -ap /tmp/attachments

[fedelemantuano]

I understood but mail-parser is a parser. If you want store sample on filesystem you should manage possible issues.
I can't introduce extra logic.

[ad-m]

In my opinion, proper decoding of binarny attachments to a binary form native to Python is a part of parsing. In my opinion, the logic around decoder_map is an element of the project. This is in the scope of the project as much as the date parsing that is present today. Of course, saving attachments is out of the project. Parsing attachments of mail to the native binary form does not require writing them to the disk.

[louis-red]

First of all @fedelemantuano, thank you for your awesome module.

On this issue though, from my POV as an user, I stand on @ad-m's side.
Maybe you think the attachments decoding is a trivial task, but it is one that will be done by each user that is interested in the attachments, and they will have to implement that little bit of logic in their code after having looked at that issue.

Maybe what is best on the user side is a common binary format for the payload, and additional logic should be kept (and possibly simplified) on the module side ?

[fedelemantuano]

I use mail-parser in SpamScope tool. I developed a function that writes the attachments (see here).
I use it every days and works well.