Update July 16th 2020: A reader has pointed out to me that the regular expression did not (or did not always) match if the filename of the attachment contained non-ASCII characters, opening a simple way to circumvent this header check. I was able to reproduce this behavior by sending a mail with a single attachment “täst.zip” using Evolution which arrived at Postfix MTA with a MIME-structure like this:
...
Content-Type: multipart/mixed; boundary="=-PAoNeMrNohfkW7sWEPJ5"
...
--=-PAoNeMrNohfkW7sWEPJ5
Content-Type: application/zip; name*=ISO-8859-1''t%E4st.zip
Content-Disposition: attachment; filename*=ISO-8859-1''t%E4st.zip
...
Note the value of the Content-Type header, and there the part name*=ISO-8859-1''t%E4st.zip.
Please compare this to what arrives if i send a mail with an attachment “test.zip” instead:
Content-Type: application/zip; name="test.zip"
Content-Disposition: attachment; filename="test.zip"
In the below suggestion for mime_header_checks i have made the following changes:
- Change = to \*?= to allow for RFC 2231 Parameter Value Character Set and Language Information.
- Include the surrounding sturcture from the second example in the EXAMPLES section of http://www.postfix.org/header_checks.5.html which specifically covers the case that the “.” in the filename could arrive encoded as quoted printable =2E.
Here is a pcre-entry for Postfix’ mime_header_checks that will cause Postfix to reject any email containing
- a file potentially containing code that is executable on Microsoft operating systems (note that this also includes filenames ending with .js) or
- a document for Microsoft Office (including Access, Excel, Powerpoint, Visio and Word including RTF Documents) or
- some archive types (ZIP-, 7Zip-, LHA-Archives and MS Exchange data in TNEF format):
# Contents of file "/etc/postfix/mime_header_checks":
/^Content-(Disposition|Type).*name\s*\*?=\s*"?([^;]*(\.|=2E)(
accd[bert]|
do(b|[ct][mx]?)|rtf|
pp(am|(s|t)[mx]?)|pot[mx]?|sld[mx]|
v[dt]x|vs[dsxt]|
xl(am?|l|m|[st][mx]?|sb|w)|
386|
ad[ep]|app|as[dfx]|
ba[st]|
cab|c[bp]l|chm|cmd|com|crt|csh|
dll|
exe|
fxp|
hlp|ht[aor]|
in[fips]|isp|
jar|jse?|
ksh|
lib|lnk|
md[bet]|ms[cipt]|
ocx|ops|
pcd|pif|prg|
reg|
sc[rt]|sh[bms]?|swf|sys|
url|
vb[esx]|vcs|vxd|
wm[dsz]|
ws[cfh]|
7z|lha|tnef|zip))(\?=)?"?\s*(;|$)/x
REJECT Attachment of type $2 not accepted
