External filters not working
Posted: Mon Dec 31, 2012 12:09 pm
It seems that NS has the ability to scan plugin content using an external utility. NS documentation all over the place mention of Blitzableiter, but then it is very old and probably abondoned, so I decided to write my own, with the help of this post ( http://forums.informaction.com/viewtopi ... 582#p38005 ).
(The configuration below is targeted towards Linux, however, a similar thing has been tried for Windows with the same filters ( http://forums.informaction.com/viewtopic.php?f=7&t=9990 ) with the same results as me.)
I downloaded the Avast4Linux scanner which contains a CLI scanner, which can be invoked as follows:
Of course the antivirus doesn't act like Blitzableiter would, so I wrote a shell script that acts as a middleman within the script and avast scanner. The script accepts arguments in the following form:
The source is as below:
Then I made it executable (scripts and programs you download or write/compile aren't executable by default, they have to be made executable):
While setting the external filter in NS, the settings were not applied immediately. I thought that the change would take place after a restart, so I restarted Firefox to apply the changes. Noscript still kept forgetting and I had to set the preference multiple number of times to get it working.
I did not set any exceptions. The MIMEtypes to be scanned are:
Now, to test whether it is working, I went to Youtube and tried to watch a video, and I found out that video content takes forever to load. Is it a bug in Noscript?
This is not a problem with the script or with the antivirus. I tested my script before using it as an external filter, with both malicious and non-malicious files, and it works correctly.
Or am I missing something?
Thanks in advance.
EDIT: I am using Ubuntu 10.04 and Firefox 17.0.1, despite whatever my UA says below.
[edited comments in the script to remove ambiguity]
(The configuration below is targeted towards Linux, however, a similar thing has been tried for Windows with the same filters ( http://forums.informaction.com/viewtopic.php?f=7&t=9990 ) with the same results as me.)
I downloaded the Avast4Linux scanner which contains a CLI scanner, which can be invoked as follows:
Code: Select all
avast [FILE]Code: Select all
nsfilter.sh [INPUT_FILE] [OUTPUT_FILE]Code: Select all
#!/bin/bash
# This script acts as an interface between the antivirus and NS. This script is targeted at avast antivirus, however, if you use any other antivirus, please modify the later sections according to the values it returns. Avast returns 0 for clean file, 1-5 for infected files, and others for errors with the antivirus itself.
# Point filterpath to whereever the antivirus binary file lies.
filterpath=/usr/bin/avast
# Check if we have both parameters
if [ -z "$1" ] || [ -z "$2" ] ; then
zenity --error --text "This script was invoked without proper parameters."
exit 2
# Check if the input file is readable
elif [ ! -r "$1" ] ; then
zenity --error --text "The file to be scanned is not readable."
exit 3
fi
# Store the output and error code
# `-n' is avast specific, to tell it not to print statistics. Please remove this option if you use another antivirus.
report=`"$filterpath" -n "$1" &> /dev/stdout`
errorlevel=$?
# File is clean, and can be copied over.
if [ $errorlevel == 0 ] ; then
# Enable the next line only to test if the script is working. During browsing, you don't want to be interfered with "clean file, will be loaded" messages.
# zenity --info --text "The plugin content was found to be clean and will be loaded."
report=`cp "$1" "$2" &> /dev/stdout`
# Handle file copying errors
if [ $? != 0 ] ; then
zenity --error --text "An error occured while copying the file\n\n$report"
exit 4
fi
exit 0
# File is malicious, display warning to user
elif [ $errorlevel -gt 0 ] && [ $errorlevel -lt 6 ] ; then
zenity --warning --text "The plugin content was found to be malicious and will not be loaded.\n\n$report"
exit 1
# Error on the part of the antivirus or system setup
else
zenity --error --text "The external filter returned an error:\n\n$report"
exit 4
fi
Code: Select all
chmod +x ~/nsfilter.shI did not set any exceptions. The MIMEtypes to be scanned are:
Code: Select all
shockwave|futuresplash|java|pdfThis is not a problem with the script or with the antivirus. I tested my script before using it as an external filter, with both malicious and non-malicious files, and it works correctly.
Or am I missing something?
Thanks in advance.
EDIT: I am using Ubuntu 10.04 and Firefox 17.0.1, despite whatever my UA says below.
[edited comments in the script to remove ambiguity]
