Skip to content

Follow-up: support ignore_junk_filter in archive extraction and improve batch detection - #3265

Merged
doomedraven merged 2 commits into
masterfrom
feature/junk-filter-improvements
Sep 30, 2026
Merged

doomedraven merged 2 commits into
masterfrom
feature/junk-filter-improvements

Conversation

@doomedraven

Copy link
Copy Markdown
Collaborator

Description

Follow-up improvements to PR #3258 (ignore_junk_filter option):

  1. Support ignore_junk_filter in Archive Extraction (_sf_children):

    • Propagated ignore_junk_filter through demux_sflock() into _sf_children().
    • Allowed extraction of matching files even if their extension is not in demux_extensions_list.
  2. Case-Insensitive @echo off Batch Detection:

    • In analyzer/windows/lib/core/packages.py (choose_package()), made @echo off check case-insensitive (b"@echo off" in file_content.lower()) so polyglot scripts (such as polyshell.txt using @ECHO OFF) correctly resolve to the batch package rather than falling back to generic (which only opens Notepad on Windows).
  3. Register batch and autoit in sandbox_packages:

    • Added batch and autoit to the sandbox_packages tuple in lib/cuckoo/core/data/tasking.py.
  4. Unit Tests:

    • Added unit tests in tests/test_demux.py covering:
      • Junk filter default rejection (string & bytes filenames)
      • Explicit disabling (ignore_junk_filter=0)
      • Allowed variants (ignore_junk_filter=1, true, yes)
      • _sf_children() extraction behavior with and without ignore_junk_filter.

doomedraven added 2 commits September 30, 2026 12:46
…ove batch detection

- Propagate ignore_junk_filter to _sf_children and demux_sflock to support archive extractions
- Make @echo off detection case-insensitive in choose_package
- Add batch and autoit to sandbox_packages in tasking
- Add unit tests for junk filter and ignore_junk_filter in test_demux
@doomedraven
doomedraven merged commit 82e002b into master Sep 30, 2026
7 checks passed
@doomedraven
doomedraven deleted the feature/junk-filter-improvements branch September 30, 2026 12:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant