RTIR extracting IP addresses from a binary attachment

RTIR
1

There is a weird bug we’ve encountered when RTIR doesn’t find any IP addresses in the email body, it seems to start parsing attachments (even png’s):

image
image780×497 8.8 KB

However if you send the same image again but with just 8.8.8.8 in the body then it correctly extracts only that IP address. Can’t really upload the original image, but managed to reproduce by just adding one of the 'IP’s it finds (‘ccc8::’) into a random png (image gets broken but gets parsed for IPs nonetheless)
Looks like Discourse does not like broken png’s so won’t be able to upload it. But should be easily reproducible with just breaking any handy png file by adding ‘ccc8::’ somewhere in the middle of it and sending this alone to RTIR and then the same with some real IP address in the body. Can’t reproduce on our 5.0.1 instance but the new 5.0.3 we’re working on does exhibit the bug (then again differences between both are much bigger as 5.0.1 without the bug is ubuntu from a couple years ago vs 5.0.3 a rather fresh install on Oracle Linux, so a lot of perl modules have different versions).
Doesn’t seem to be anything interesting in the logs:

[58034] [Tue Dec  6 13:52:06 2022] [debug]: Committing scrip #13 on txn #636484 of ticket #27022 (/opt/rt5/sbin/../lib/RT/Scrips.pm:293)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: Committing scrip #18 on txn #636484 of ticket #27022 (/opt/rt5/sbin/../lib/RT/Scrips.pm:293)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: About to prepare scrips for transaction #636486 (/opt/rt5/sbin/../lib/RT/Transaction.pm:189)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: Found 5 scrips for TransactionCreate stage with applicable type(s) CustomField for txn #636486 on ticket #27022 (/opt/rt5/sbin/../lib/RT/Scrips.pm:482)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: Skipping Scrip #11 because it isn't applicable (/opt/rt5/sbin/../lib/RT/Scrips.pm:337)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: Skipping Scrip #23 because it isn't applicable (/opt/rt5/sbin/../lib/RT/Scrips.pm:337)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: Skipping Scrip #27 because it isn't applicable (/opt/rt5/sbin/../lib/RT/Scrips.pm:337)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: Skipping Scrip #42 because it isn't applicable (/opt/rt5/sbin/../lib/RT/Scrips.pm:337)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: About to commit scrips for transaction #636486 (/opt/rt5/sbin/../lib/RT/Transaction.pm:212)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: Committing scrip #13 on txn #636486 of ticket #27022 (/opt/rt5/sbin/../lib/RT/Scrips.pm:293)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: Committing scrip #32 on txn #636484 of ticket #27022 (/opt/rt5/sbin/../lib/RT/Scrips.pm:293)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: About to prepare scrips for transaction #636487 (/opt/rt5/sbin/../lib/RT/Transaction.pm:189)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: Found 5 scrips for TransactionCreate stage with applicable type(s) CustomField for txn #636487 on ticket #27022 (/opt/rt5/sbin/../lib/RT/Scrips.pm:482)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: Skipping Scrip #11 because it isn't applicable (/opt/rt5/sbin/../lib/RT/Scrips.pm:337)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: Skipping Scrip #23 because it isn't applicable (/opt/rt5/sbin/../lib/RT/Scrips.pm:337)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: Skipping Scrip #27 because it isn't applicable (/opt/rt5/sbin/../lib/RT/Scrips.pm:337)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: Skipping Scrip #42 because it isn't applicable (/opt/rt5/sbin/../lib/RT/Scrips.pm:337)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: About to commit scrips for transaction #636487 (/opt/rt5/sbin/../lib/RT/Transaction.pm:212)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: Committing scrip #13 on txn #636487 of ticket #27022 (/opt/rt5/sbin/../lib/RT/Scrips.pm:293)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: Encode::Guess guessed encoding: ascii (/opt/rt5/sbin/../lib/RT/I18N.pm:583)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: Encode::Guess guessed encoding: ascii (/opt/rt5/sbin/../lib/RT/I18N.pm:583)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: About to prepare scrips for transaction #636488 (/opt/rt5/sbin/../lib/RT/Transaction.pm:189)
[58034] [Tue Dec  6 13:52:06 2022] [debug]: Found 5 scrips for TransactionCreate stage with applicable type(s) CustomField for txn #636488 on ticket #27022 (/opt/rt5/sbin/../lib/RT/Scrips.pm:482)

Scrip 32 is the SetIPFromContent that triggers on Create, no errors or warnings, it just loops 18 times through all the 'IP’s it found in the png as it adds them

2

Pretty sure this is a regression from 5.0.1, I’ve substituted file RTIR_FindIP.pm in /opt/rt5/local/plugins/RT-IR/lib/RT/Action with one from 5.0.1 and the bug is gone (though switching it back right now as no idea if anything else could get broken), sending the same image that generated 18 'IP’s generated 0 as expected, with 8.8.8.8 in body behaviour was as expected.