<space> and ";" in folder or file names returns error

[trillex]

After automatically updating to 1.6, we are seeing a lot of errors regarding file or folder names with either "" or ";"

maldet(31158): {scan} error could not read or hash ../httpdocs/tmp/templates_c/ec48cfb70f1f1843c5a24d2b3ae670db^d699142273f511bc66d93eefa94743b050a14200.module_db_tpl. navigation-tpl-009.php, do we have permission?

The error log file names look like this (chosen at random):

$ grep error /var/log/lmd.log | awk '{print $(NF-5),$(NF-4)}' | sort -u | cut -d\/ -f2-
usr/local/pem/vhosts/112688/webspace/httpdocs/tmp/templates_c/05a6607b2cafb3044d0fba182f16cc5d^d699142273f511bc66d93eefa94743b050a14200.module_db_tpl. navigation-tpl-009.php,
usr/local/pem/vhosts/112688/webspace/httpdocs/tmp/templates_c/06ebe678c3e8cff0dd3eeee6d282dfe4^d699142273f511bc66d93eefa94743b050a14200.module_db_tpl. navigation-tpl-009.php,
usr/local/pem/vhosts/112688/webspace/httpdocs/tmp/templates_c/08d5d3ecb1e3f4d7f7784be05920d8bd^d699142273f511bc66d93eefa94743b050a14200.module_db_tpl. navigation-tpl-009.php,
usr/local/pem/vhosts/112688/webspace/httpdocs/tmp/templates_c/08e5e6c1771b5a8fd577efb93d76cbed^d699142273f511bc66d93eefa94743b050a14200.module_db_tpl. navigation-tpl-009.php,
usr/local/pem/vhosts/112688/webspace/httpdocs/tmp/templates_c/09f7fc6f7e25129a942e1fd01ad36098^d699142273f511bc66d93eefa94743b050a14200.module_db_tpl. navigation-tpl-009.php,
usr/local/pem/vhosts/112688/webspace/httpdocs/tmp/templates_c/159b51736ee22a4ad0496aeed741fac5^d699142273f511bc66d93eefa94743b050a14200.module_db_tpl. navigation-tpl-009.php,
usr/local/pem/vhosts/112688/webspace/httpdocs/tmp/templates_c/1bd32359ccf28fcae4352434a44387c0^d699142273f511bc66d93eefa94743b050a14200.module_db_tpl. navigation-tpl-009.php,
usr/local/pem/vhosts/112688/webspace/httpdocs/tmp/templates_c/2238715a188dde960e80abbc1e5fd697^d699142273f511bc66d93eefa94743b050a14200.module_db_tpl. navigation-tpl-009.php,
usr/local/pem/vhosts/112688/webspace/httpdocs/tmp/templates_c/a097cae645ecf5e0aaaed5577eb8b295^02234e5b263ba20351bf2a5ebb4b57d4402a3cab.module_file_tpl.MenuManager;simple_navigation.tpl.php,
usr/local/pem/vhosts/112688/webspace/httpdocs/tmp/templates_c/fe6027eebaf8799aa593796c10daa75e^02234e5b263ba20351bf2a5ebb4b57d4402a3cab.module_file_tpl.MenuManager;simple_navigation.tpl.php,

Let me know if you need additional information.

[rfxn]

This is something that was likely taking place previously in v1.5, just that it was being suppressed. There has been allot of work to improve file handling in v1.6. However, these file names are certainly a mixed affair of constraints.

I will do some testing this week and see what I can come up with for handling.

Thanks for reporting

[magician7]

@rfxn It's probably related to this - if I scan files which have spaces in filename then maldet hangs up.
In htop it looks like this:
bash /usr/local/sbin/maldet -a /home/maxp/domains/example.com/public_html/beta/images
12117 root 20 0 13860 1056 888 S 0.0 0.0 0:00.00 │ ├─ awk {print$1}
12116 root 20 0 13952 2724 420 S 0.0 0.1 0:00.00 │ └─ bash /usr/local/sbin/maldet -a /home/maxp/domains/example.com/public_html/beta/images
12118 root 20 0 6720 700 600 S 0.0 0.0 0:00.00 │ └─ /usr/bin/md5sum /home/maxp/domains/example.com/public_html/beta/images/maxp/galeria/all/IMG_5556 - copy.jpg

[jhstatewide]

https://github.com/rfxn/linux-malware-detect/blob/master/files/internals/functions#L1181

I believe the bug is here...

Try escaping the quotes:

hash=`eval $md5sum \"$file\" | awk '{print$1}'`

[rfxn]

fixed and committed for release in 1.6.1

[melincredo]

Hi,

Latest maldet version has covered the bug of escaping quotes but still getting error.

Please suggest as permission is there.

Jun 03 16:37:46 testbed maldet(15250): {scan} error could not read or hash /mnt/data/home/ffne9922/public_html/web/app/themes/fingo/node_modules/table/node_modules/ajv/lib/refs/$data.json, do we have permission?
Jun 03 16:37:46 testbed maldet(15250): {scan} error could not read or hash /mnt/data/home/ffne9922/public_html/web/app/themes/fingo/node_modules/table/node_modules/ajv/lib/$data.js, do we have permission?
Jun 03 16:46:17 testbed maldet(15250): {scan} error could not read or hash /mnt/data/home/ffne9922/public_html/web/app/themes/fingo/node_modules/extract-text-webpack-plugin/node_modules/ajv/lib/refs/$data.json, do we have permission?
Jun 03 16:46:17 testbed maldet(15250): {scan} error could not read or hash /mnt/data/home/ffne9922/public_html/web/app/themes/fingo/node_modules/extract-text-webpack-plugin/node_modules/ajv/lib/$data.js, do we have permission?
Jun 03 16:47:18 testbed maldet(15250): {scan} error could not read or hash /mnt/data/home/ffne9922/public_html/web/app/themes/fingo/node_modules/webpack/node_modules/ajv/lib/refs/$data.json, do we have permission?
Jun 03 16:47:18 testbed maldet(15250): {scan} error could not read or hash /mnt/data/home/ffne9922/public_html/web/app/themes/fingo/node_modules/webpack/node_modules/ajv/lib/$data.js, do we have permission?

[melincredo]

@rfxn -- Anyone able to assist ?

[jhstatewide]

Assist with what? This issue was closed in 1.6.1

[melincredo]

@jhstatewide this issue, it gives permission error.