From 0b9f0d5b34cc15b4e2d4df6a4b05d324eef3f24d Mon Sep 17 00:00:00 2001 From: kirk-sayre-work Date: Wed, 11 Dec 2019 12:53:35 -0600 Subject: [PATCH] Fixed bug in detecting MHT files. --- oletools/olevba.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/oletools/olevba.py b/oletools/olevba.py index e8fff78..6f7d642 100644 --- a/oletools/olevba.py +++ b/oletools/olevba.py @@ -2627,8 +2627,11 @@ class VBA_Parser(object): # and even whitespaces in between "MIME", "-", "Version" and ":". The version number is ignored. # And the line is case insensitive. # so we'll just check the presence of mime, version and multipart anywhere: - if self.type is None and b'mime' in data_lowercase and b'version' in data_lowercase \ - and b'multipart' in data_lowercase: + if (self.type is None and + b'mime' in data_lowercase and + b'version' in data_lowercase and + b'multipart' in data_lowercase and + abs(data_lowercase.index(b'version') - data_lowercase.index(b'mime')) < 20): self.open_mht(data) #TODO: handle exceptions #TODO: Excel 2003 XML -- libgit2 0.21.4