Merge pull request #108 from demisto/fix-attachment-bug

Fix attachment bug

Author: moishce

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 v0.1.34
 * Fixed an issue that prevented the headers from being parsed correctly for eml files (unknown-8bit encoding).
+* Fixed an issue that email with attachment was parsed incorrectly for eml files.
 
 v0.1.33
 * Fixed an issue where html parts were not parsed properly in EML files.

parse_emails/handle_eml.py

@@ -110,13 +110,9 @@ def handle_eml(file_path, b64=False, file_name=None, parse_only_headers=False, m
         while parts:
             part = parts.pop()
 
-            payload = part.get_payload()
-
             logger.debug(f'Iterating over parts. Current part: {part.get_content_type()=}')
             if (part.is_multipart() or part.get_content_type().startswith('multipart')) \
-                    and "attachment" not in part.get("Content-Disposition", "") or \
-                        (payload and isinstance(payload, list) and len(payload) == 1 and
-                         payload[0].get_content_type() == 'text/html'):
+                    and "attachment" not in part.get("Content-Disposition", ""):
                 parts += [part_ for part_ in part.get_payload() if isinstance(part_, email.message.Message)]
 
             elif part.get_filename()\
@@ -200,13 +196,16 @@ def handle_eml(file_path, b64=False, file_name=None, parse_only_headers=False, m
                             attachment_file_name = individual_message.get_filename()
                             attachment_content_id = individual_message.get('Content-ID')
                             attachment_content_disposition = individual_message.get('Content-Disposition')
-                            if attachment_file_name is None:
-                                attachment_file_name = f"unknown_file_name{i}"
-
-                            attachment_content.append(msg_info)
-                            attachment_names.append(attachment_file_name)
-                            attachment_content_ids.append(attachment_content_id)
-                            attachment_content_dispositions.append(attachment_content_disposition)
+                            if not attachment_file_name and not attachment_content_ids and 'text/html' in individual_message.get_content_type():
+                                html = decode_content(individual_message)
+                            else:
+                                if attachment_file_name is None:
+                                    attachment_file_name = f"unknown_file_name{i}"
+
+                                attachment_content.append(msg_info)
+                                attachment_names.append(attachment_file_name)
+                                attachment_content_ids.append(attachment_content_id)
+                                attachment_content_dispositions.append(attachment_content_disposition)
                     else:
                         file_content = part.get_payload(decode=True)
                         if attachment_file_name.endswith('.p7s') or not file_content:

parse_emails/tests/parse_emails_test.py

@@ -991,3 +991,24 @@ def test_handle_eml_unknown8bit():
     email_parser = EmailParser(file_path='parse_emails/tests/test_data/test-unknown-8bit.eml')
     results = email_parser.parse()
     assert results['From'] == '[email protected]'
+
+
+def test_multipart_eml_with_eml_attachment_containing_html_body():
+    """
+    Given:
+     - eml file with attached another eml file with text/html content.
+    When:
+     - parsing the file.
+    Then:
+     - make sure the msg was correctly parsed.
+    """
+    test_path = 'parse_emails/tests/test_data/multipart_with_eml_attachment_containing_html.eml'
+
+    email_parser = EmailParser(file_path=test_path, max_depth=2)
+    results = email_parser.parse()
+
+    assert len(results) == 2
+    assert results[0]["HTML"] == ""
+    assert results[0]["Attachments"] == "original_message.eml"
+    assert len(results[0]["AttachmentsData"]) > 0
+    assert results[1]["ParentFileName"] == "multipart_with_eml_attachment_containing_html.eml"

parse_emails/tests/test_data/multipart_with_eml_attachment_containing_html.eml

@@ -0,0 +1,28 @@
+To: [email protected]
+From: [email protected]
+Subject: Your Subject
+Date: 14 Jan 2025 12:00:00 +0000
+Content-Type: multipart/mixed; boundary="000000000000e915c3062bcd115c"
+
+--000000000000e915c3062bcd115c
+Content-Type: text/plain; charset="UTF-8"
+Content-Transfer-Encoding: base64
+
+Email with attached another email
+
+--000000000000e915c3062bcd115c
+Content-Type: message/rfc822; name="original_message.eml"
+Content-Disposition: attachment; filename="original_message.eml"
+Content-Transfer-Encoding: 8bit
+X-Attachment-Id: f0af9d461a78b41c_0.1
+
+From: [email protected]
+To: [email protected]
+Date: 16 Jan 2025 05:31:24 +0000
+Subject: =?utf-8?B?QXR0YWNoZWQgZW1haWwgc3ViamVjdA==?=
+Content-Type: text/html; charset="utf-8"
+Content-Transfer-Encoding: base64
+
+PG1ldGEgaHR0cC1lcXVpdj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0b
+Ww7IGNoYXJzZXQ9dXRmLTgiPg0KPHA+QXR0YWNoZWQgZW1haWwgSFRNTDwvcD4=
+--000000000000e915c3062bcd115c--