view release on metacpan or  search on metacpan

include/clamav/clamd_verdict.h  view on Meta::CPAN

typedef struct {
    int   state;
    char  signature[CC_SIGLEN];    /* "" when there is none */
    char  reason[CC_REASONLEN];    /* why unscannable; "" otherwise */
} cc_verdict;

/* The two families that mean "clamd did not see the content".
 *
 * NOT every Heuristics.* name: Heuristics.Phishing.* and
 * Heuristics.OLE2.ContainsMacros are clamd saying it LOOKED and thinks
 * the thing is bad, which is a detection. These two are clamd saying it
 * could not look, which is the opposite and must never read as clean. */
#define CC_PFX_LIMITS    "Heuristics.Limits.Exceeded."
#define CC_PFX_ENCRYPTED "Heuristics.Encrypted."

static int cc_starts_with(const char *s, size_t len, const char *pfx) {
    size_t n = strlen(pfx);
    return len >= n && memcmp(s, pfx, n) == 0;
}

t/60-verdict.t  view on Meta::CPAN

    ['fd[11]: Heuristics.Encrypted.DOC FOUND',               'unscannable', 'Heuristics.Encrypted.DOC',               'Encrypted'],
    ['INSTREAM size limit exceeded. ERROR',                  'unscannable', undef,                                    'StreamMaxLength'],
    ['/x: File path check failure: Permission denied. ERROR','error',       undef,                                    undef],
    ['UNKNOWN COMMAND',                                      'error',       undef,                                    undef],
    ['',                                                     'error',       undef,                                    undef],
    ['something nobody has ever seen',                       'error',       undef,                                    undef],

    # NOT unscannable: clamd looked and thinks the thing is bad. Only the
    # Limits.Exceeded and Encrypted families mean "I could not look".
    ['fd[11]: Heuristics.Phishing.Email.SpoofedDomain FOUND','infected',   'Heuristics.Phishing.Email.SpoofedDomain', undef],
    ['fd[11]: Heuristics.OLE2.ContainsMacros FOUND',         'infected',   'Heuristics.OLE2.ContainsMacros',          undef],

    # a path containing ": " must not eat the signature
    ['/tmp/a: b/c: Eicar-Test-Signature FOUND',              'infected',   'Eicar-Test-Signature',                    undef],
);

for my $case (@SHAPES) {
    my ($reply, $state, $sig, $reason) = @$case;
    my $srv = FakeClamd->new(mode => 'literal', literal => $reply);
    my $c   = ClamAV::Clamd->new(socket => $srv->path, reply_timeout => 10);
    my $v   = $c->scan('payload');