From 97f89f43e7084af0b984a3f8be828307d14ec1a4 Mon Sep 17 00:00:00 2001 From: "Val S." Date: Fri, 10 Oct 2025 20:32:23 -0400 Subject: [PATCH] Fix issue detecting VBA projects Previously for documents containing VBA projects, the VBA was treated as an object within the document and not as a normalized version of the document. I apparently switched it say that the VBA is a normalized version of the document. This kind of makes sense in that presently Javascript extracted from HTML is treated as a normalized version of the HTML. But it probably shouldn't. Normalized layers are treated as the same file as the parent. So now those older signatures that match on VBA projects using "Container:CL_TYPE_MSOLE2" are failing to match. So this commit switches it back. VBA project bits written out to a temp file for scanning will be treated as being contained within the document. CLAM-2896 --- libclamav/scanners.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libclamav/scanners.c b/libclamav/scanners.c index f21494545..d432a6117 100644 --- a/libclamav/scanners.c +++ b/libclamav/scanners.c @@ -1665,7 +1665,7 @@ static cl_error_t cli_ole2_tempdir_scan_vba_new(const char *dir, cli_ctx *ctx, s goto done; } - ret = cli_scan_desc(tempfd, ctx, CL_TYPE_SCRIPT, false, NULL, AC_SCAN_VIR, NULL, "extracted-vba-project", tempfile, LAYER_ATTRIBUTES_NORMALIZED); + ret = cli_scan_desc(tempfd, ctx, CL_TYPE_SCRIPT, false, NULL, AC_SCAN_VIR, NULL, "extracted-vba-project", tempfile, LAYER_ATTRIBUTES_NONE); if (CL_SUCCESS != ret) { goto done; }