Commit 2f7ee0f465279447224709537f9ef4033f68781c

Authored by decalage2
1 parent 888bf456

rtfobj: removed "\rtf" from the list of destination control words, fixes #522

Showing 1 changed file with 6 additions and 2 deletions
oletools/rtfobj.py
@@ -90,8 +90,9 @@ http://www.decalage.info/python/oletools @@ -90,8 +90,9 @@ http://www.decalage.info/python/oletools
90 # 2018-09-11 v0.54 PL: - olefile is now a dependency 90 # 2018-09-11 v0.54 PL: - olefile is now a dependency
91 # 2019-07-08 v0.55 MM: - added URL carver for CVE-2017-0199 (Equation Editor) PR #460 91 # 2019-07-08 v0.55 MM: - added URL carver for CVE-2017-0199 (Equation Editor) PR #460
92 # - added SCT to the list of executable file extensions PR #461 92 # - added SCT to the list of executable file extensions PR #461
  93 +# 2019-12-16 v0.55.2 PL: - \rtf is not a destination control word (issue #522)
93 94
94 -__version__ = '0.55' 95 +__version__ = '0.55.2'
95 96
96 # ------------------------------------------------------------------------------ 97 # ------------------------------------------------------------------------------
97 # TODO: 98 # TODO:
@@ -301,7 +302,10 @@ DESTINATION_CONTROL_WORDS = frozenset(( @@ -301,7 +302,10 @@ DESTINATION_CONTROL_WORDS = frozenset((
301 b"oleclsid", b"operator", b"panose", b"password", b"passwordhash", b"pgp", b"pgptbl", b"picprop", b"pict", b"pn", b"pnseclvl", 302 b"oleclsid", b"operator", b"panose", b"password", b"passwordhash", b"pgp", b"pgptbl", b"picprop", b"pict", b"pn", b"pnseclvl",
302 b"pntext", b"pntxta", b"pntxtb", b"printim", 303 b"pntext", b"pntxta", b"pntxtb", b"printim",
303 b"propname", b"protend", b"protstart", b"protusertbl", 304 b"propname", b"protend", b"protstart", b"protusertbl",
304 - b"result", b"revtbl", b"revtim", b"rtf", b"rxe", b"shp", b"shpgrp", b"shpinst", b"shppict", b"shprslt", b"shptxt", 305 + b"result", b"revtbl", b"revtim",
  306 + # \rtf should not be treated as a destination (issue #522)
  307 + #b"rtf",
  308 + b"rxe", b"shp", b"shpgrp", b"shpinst", b"shppict", b"shprslt", b"shptxt",
305 b"sn", b"sp", b"staticval", b"stylesheet", b"subject", b"sv", b"svb", b"tc", b"template", b"themedata", b"title", b"txe", b"ud", 309 b"sn", b"sp", b"staticval", b"stylesheet", b"subject", b"sv", b"svb", b"tc", b"template", b"themedata", b"title", b"txe", b"ud",
306 b"upr", b"userprops", b"wgrffmtfilter", b"windowcaption", b"writereservation", b"writereservhash", b"xe", b"xform", 310 b"upr", b"userprops", b"wgrffmtfilter", b"windowcaption", b"writereservation", b"writereservhash", b"xe", b"xform",
307 b"xmlattrname", b"xmlattrvalue", b"xmlclose", b"xmlname", b"xmlnstbl", b"xmlopen", 311 b"xmlattrname", b"xmlattrvalue", b"xmlclose", b"xmlname", b"xmlnstbl", b"xmlopen",