cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
400
Views
0
Helpful
2
Replies

Problem with attachment-filename rule in cisco esa (Asyncos 14.2.1)

Hallowelt
Beginner
Beginner

Hi,

we've got a problem with a message filter rule. It says simplified

if (attachment-filename == "(?i)\\.(xls|xlsm)$"){

 notify(...);

  drop();

}

When someone adds an attachment, created as pdf from an legacy excel file (Quote.xls) the pdf converter writes something like

------

23 0 obj
<</UF(Quote.xls)/EF<</UF 22 0 R/F 22 0 R>>/Desc(Quote as Excel file)/Type/Filespec/F(Quote.xls)>>
endobj

-------

into the PDF-File.

When I try to send an email with that attachment (named Quote.pdf) the Message-Filter-Rule above matches and drops the message. 

After Changing the line above in the PDF from

<</UF(Quote.xls)/EF<</UF 22 0 R/F 22 0 R>>/Desc(Quote as Excel file)/Type/Filespec/F(Quote.xls)>>

to

<</UF(Quote.xlsx)/EF<</UF 22 0 R/F 22 0 R>>/Desc(Quote as Excel file)/Type/Filespec/F(Quote.xlsx)>>

I can sent the attachment named Quote.pdf as expected.

Any idea?

Thanks,

Harald

1 Accepted Solution

Accepted Solutions

UdupiKrishna
Cisco Employee
Cisco Employee

The "Type/FileSpec" refers to a file specification object within the PDF so that it can refer to contents of another file. 

I ran a similar test,

1. Created a legacy xls file, saved a pdf copy of it which Microsoft Excel provides as an option.

2. Metadata doesnt show any file spec line (sorta expected). 

3. Message filter configured with the same conditions and passing this converted PDF was not caught by it.

I don't have a PDF file right now with file spec entries to further test the filter behaviour. 

View solution in original post

2 Replies 2

UdupiKrishna
Cisco Employee
Cisco Employee

The "Type/FileSpec" refers to a file specification object within the PDF so that it can refer to contents of another file. 

I ran a similar test,

1. Created a legacy xls file, saved a pdf copy of it which Microsoft Excel provides as an option.

2. Metadata doesnt show any file spec line (sorta expected). 

3. Message filter configured with the same conditions and passing this converted PDF was not caught by it.

I don't have a PDF file right now with file spec entries to further test the filter behaviour. 

Thanks, that expains it and I learned something new about file embedding in pdf files

Harald

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers