with ESA upgrade to 14.2 macro-detection-rule () has changed

[Lemat]

with 14.0 version the filter:

Macro_filter_strip: if (macro-detection-rule (['Microsoft Office Files'])) { drop-macro-enabled-attachments(['Microsoft Office Files'], "The document attached to this email contained potentially dangerous macros. The file has been removed as a safety measure."); }

was working on files which actually had macros in them.

With 14.2 the filter drops all macro-enabled attachments like .xlsm which have no macros in them (empty .xlsm document is dropped)

Is this intentional change or a bug?

[UdupiKrishna · Accepted solution]

It's a bug and not intentional - CSCwb88469

I ran a test with empty excel on 14.2.0-620 and I dont see this problem anymore. There were updates added to macro detection after similar complaints and there were updates pushed to fix this behaviour.