Problem with attachment-filename rule in cisco esa (Asyncos 14.2.1)

[Hallowelt]

Hi,

we've got a problem with a message filter rule. It says simplified

if (attachment-filename == "(?i)\\.(xls|xlsm)$"){

 notify(...);

  drop();

}

When someone adds an attachment, created as pdf from an legacy excel file (Quote.xls) the pdf converter writes something like

------

23 0 obj
<</UF(Quote.xls)/EF<</UF 22 0 R/F 22 0 R>>/Desc(Quote as Excel file)/Type/Filespec/F(Quote.xls)>>
endobj

-------

into the PDF-File.

When I try to send an email with that attachment (named Quote.pdf) the Message-Filter-Rule above matches and drops the message. 

After Changing the line above in the PDF from

<</UF(Quote.xls)/EF<</UF 22 0 R/F 22 0 R>>/Desc(Quote as Excel file)/Type/Filespec/F(Quote.xls)>>

to

<</UF(Quote.xlsx)/EF<</UF 22 0 R/F 22 0 R>>/Desc(Quote as Excel file)/Type/Filespec/F(Quote.xlsx)>>

I can sent the attachment named Quote.pdf as expected.

Any idea?

Thanks,

Harald

[Udupi Krishna. · Accepted solution]

The "Type/FileSpec" refers to a file specification object within the PDF so that it can refer to contents of another file. 

I ran a similar test,

1. Created a legacy xls file, saved a pdf copy of it which Microsoft Excel provides as an option.

2. Metadata doesnt show any file spec line (sorta expected). 

3. Message filter configured with the same conditions and passing this converted PDF was not caught by it.

I don't have a PDF file right now with file spec entries to further test the filter behaviour. 

[Hallowelt]

Thanks, that expains it and I learned something new about file embedding in pdf files

Harald