You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Ausnahmeregeln fuer Sparkasse und Sparkasse Langen-Seligenstadt
X:.+(facebook|twitter|instagram|youtube|play.google|apps.apple).com([/?].)?:.+mailing.(sparkasse|sls-direkt).de([/?].)?:17-
X:.+(sparkasse|sls-direkt).de([/?].)?:.+mailing.(sparkasse|sls-direkt).de([/?].)?:17-
# Ausnahmeregel fuer Amazon und Amazon-Subdomains
X:.+.amazon.(at|ca|co.uk|co.jp|de|fr)([/?].)?:.+.amazon.com([/?].)?:17-
--- END ---
It contains 16 lines in total (correct, with comment lines and blank lines).
Now freshclam remove all comment lines incl. the line itself, similar to this:
COUNT_SIGS_WHITELIST="$(sed -E '/^[\r\n\t\f\v ]*#/d;s/#.*//g' "/var/lib/clamav/whitelist.wdb" | wc -l | cut -d ' ' -f 1)" && wait ${!}
The result of ${COUNT_SIGS_WHITELIST} are 7 lines and this is the amount of "sigs" what freshclam counts, but this is wrong.
Maybe Correct handle (works in my case):
COUNT_SIGS_WHITELIST="$(grep -E -o '^[^#]*' "/var/lib/clamav/whitelist.wdb" | wc -l | cut -d ' ' -f 1)" && wait ${!}
The result of ${COUNT_SIGS_WHITELIST} are now 3 lines and this is the right result, I have 3 "sigs" in total (3 filled lines after removing all comment lines and blank lines).
I'm on Ubuntu 24.04.1 and ClamAV 1.0.7
I have searched all the source code for how ClamAV countlines works, but have found nothing.
I'm pretty sure, there must be some kind of line or file cleanup.
Perhaps there are even important reasons why blank lines are not removed, but unfortunately I can't find any rules in the source code. The ticket is certainly not a high priority one, but I just wanted to point this out.
The text was updated successfully, but these errors were encountered:
micahsnyder
added a commit
to micahsnyder/clamav-micah
that referenced
this issue
Oct 30, 2024
It is no secret that freshclam counts the lines to determine the signatures in the file.
But i found a Bug in the way how freshclam handles wdb files.
My freshclam.log:
Fri Oct 18 12:00:04 2024 -> --------------------------------------
Fri Oct 18 12:00:04 2024 -> daily database available for update (local version: 27430, remote version: 27431)
Fri Oct 18 12:00:10 2024 -> daily.cld updated (version: 27431, sigs: 2067283, f-level: 90, builder: raynman)
Fri Oct 18 12:00:10 2024 -> main.cvd database is up-to-date (version: 62, sigs: 6647427, f-level: 90, builder: sigmgr)
Fri Oct 18 12:00:10 2024 -> bytecode.cvd database is up-to-date (version: 335, sigs: 86, f-level: 90, builder: raynman)
Fri Oct 18 12:00:10 2024 -> Downloading whitelist.wdb [100%]
Fri Oct 18 12:00:10 2024 -> whitelist.wdb updated (version: custom database, sigs: 7)
You see sigs 7
My whitelist.wdb source code:
--- START --
#
#
Phishing-Whitelist whitelist.wdb#
newcomer01@newcomer01-MS-7A40#
ClamAV - 1.0.7 (ClamAV 1.0.7) - 18.10.2024, 10:22:55 +0200#
/var/lib/clamav_cronjob/clamav_whitelistmake.sh#
Stand 28.09.2024 (1.0.7)#
#
Ausnahmeregeln fuer Sparkasse und Sparkasse Langen-SeligenstadtX:.+(facebook|twitter|instagram|youtube|play.google|apps.apple).com([/?].)?:.+mailing.(sparkasse|sls-direkt).de([/?].)?:17-
X:.+(sparkasse|sls-direkt).de([/?].)?:.+mailing.(sparkasse|sls-direkt).de([/?].)?:17-
#
Ausnahmeregel fuer Amazon und Amazon-SubdomainsX:.+.amazon.(at|ca|co.uk|co.jp|de|fr)([/?].)?:.+.amazon.com([/?].)?:17-
--- END ---
It contains 16 lines in total (correct, with comment lines and blank lines).
Now freshclam remove all comment lines incl. the line itself, similar to this:
COUNT_SIGS_WHITELIST="
$(sed -E '/^[\r\n\t\f\v ]*#/d;s/#.*//g' "/var/lib/clamav/whitelist.wdb" | wc -l | cut -d ' ' -f 1)
" && wait ${!}The result of ${COUNT_SIGS_WHITELIST} are 7 lines and this is the amount of "sigs" what freshclam counts, but this is wrong.
Maybe Correct handle (works in my case):
COUNT_SIGS_WHITELIST="
$(grep -E -o '^[^#]*' "/var/lib/clamav/whitelist.wdb" | wc -l | cut -d ' ' -f 1)
" && wait ${!}The result of ${COUNT_SIGS_WHITELIST} are now 3 lines and this is the right result, I have 3 "sigs" in total (3 filled lines after removing all comment lines and blank lines).
I'm on Ubuntu 24.04.1 and ClamAV 1.0.7
I have searched all the source code for how ClamAV
countlines
works, but have found nothing.I'm pretty sure, there must be some kind of line or file cleanup.
Perhaps there are even important reasons why blank lines are not removed, but unfortunately I can't find any rules in the source code. The ticket is certainly not a high priority one, but I just wanted to point this out.
The text was updated successfully, but these errors were encountered: