Strelka Emitting Empty Files

[ryanohoro]

Describe the bug

For requests encountering scanners that generate extracted files, subsequent requests to those scanners generate events with empty files.

./strelka-oneshot -l - -f src/python/strelka/tests/fixtures/test.html
{"file":{"depth":0,"flavors":{"mime":["text/html"],"yara":["html_file"]},"scanners":["ScanEntropy","ScanFooter","ScanHash","ScanHeader","ScanHtml","ScanYara"],"size":5875,"tree":{"node":"3b363598-7038-4330-a7b4-bc68e4332369","root":"3b363598-7038-4330-a7b4-bc68e4332369"}},"request":{"attributes":{"filename":"src/python/strelka/tests/fixtures/test.html"},"client":"go-oneshot","id":"3b363598-7038-4330-a7b4-bc68e4332369","source":"ubuntu","time":1674328609},"scan":{"entropy":{"elapsed":0.000335,"entropy":4.847574566795829},"footer":{"backslash":"pan\u003e\u003c/span\u003e\\n\u003c/p\u003e\\n\\n\\n\u003cp\u003e\u0026nbsp;\u003c/p\u003e\\n\\n\\n\u003c/body\u003e\\n\u003c/html\u003e","elapsed":0.000025,"footer":"pan\u003e\u003c/span\u003e\n\u003c/p\u003e\n\n\n\u003cp\u003e\u0026nbsp;\u003c/p\u003e\n\n\n\u003c/body\u003e\n\u003c/html\u003e"},"hash":{"elapsed":0.002082,"md5":"ba4ffdba7f62b2333a23a97d3ba5f1f6","sha1":"a1f900c64ed49bc111462c6fd91546640b5ac20c","sha256":"38e2d4d56acf228fcebbbf5a60a16bb36ffcee490299ea52c9b1ffbcbeb62db8","ssdeep":"96:qWJQC5siJJ+tH6STSTSTSTkvsAw2gF3BgwQWhhSTSTSTSTS/sItklIy7STSTSTSh:qOQGsiJJO3eeeIvspjJPyeeeefklCeew","tlsh":"T14AC16713EF67021152BDA0E9E0BF4A64D494560CA3465BF4B2AE477ABFCD93136122CC"},"header":{"backslash":"\u003c!DOCTYPE html\u003e\\n\u003chtml lang=\"en\"\u003e\\n\u003chead\u003e\\n    \u003ctitle","elapsed":0.000021,"header":"\u003c!DOCTYPE html\u003e\n\u003chtml lang=\"en\"\u003e\n\u003chead\u003e\n    \u003ctitle"},"html":{"elapsed":0.005289,"scripts":[{"src":"https://example.com/example.js","type":"text/javascript"}],"spans":[{"style":"font-size:11pt"},{"style":"background-color:white"},{"style":"font-family:Calibri,sans-serif"},{"style":"font-size:52.5pt"},{"style":"color:black"},{"style":"font-size:12pt"},{"style":"font-family:\"Times New Roman\",serif"},{"style":"font-size:10.5pt"},{"style":"font-family:\"Arial\",sans-serif"}],"title":"Lorem Ipsum","total":{"extracted":1,"forms":0,"frames":0,"inputs":0,"scripts":2,"spans":35}},"yara":{"elapsed":0.002051,"matches":["test"]}}}
{"file":{"depth":1,"flavors":{"mime":["text/plain"],"yara":["javascript_file"]},"name":"script_1","scanners":["ScanEntropy","ScanFooter","ScanHash","ScanHeader","ScanJavascript","ScanYara"],"size":221,"source":"ScanHtml","tree":{"node":"af4d97b5-ac3b-48ad-aef2-5d914b5de5bc","parent":"3b363598-7038-4330-a7b4-bc68e4332369","root":"3b363598-7038-4330-a7b4-bc68e4332369"}},"request":{"attributes":{"filename":"src/python/strelka/tests/fixtures/test.html"},"client":"go-oneshot","id":"3b363598-7038-4330-a7b4-bc68e4332369","source":"ubuntu","time":1674328609},"scan":{"entropy":{"elapsed":0.000024,"entropy":4.620200029985679},"footer":{"backslash":"   document.body.appendChild(newParagraphElement)\\n","elapsed":0.000015,"footer":"   document.body.appendChild(newParagraphElement)\n"},"hash":{"elapsed":0.000073,"md5":"ed2a6dffc68bcbe361f4539b5f423d66","sha1":"172771134de76ede1df66cfa95a839237e485c40","sha256":"8c3e97cc7103eec2f8959b0f27e2011f09f26386131b075a59f2423c791917ff","ssdeep":"6:8/tuR78mgO9lV3K0Ji8mOFf0/tuRhBeJY1lLB/etuRMv:8/tuRYu80J17F8/tuRhBein2tuRu","tlsh":"T159D0A715143A07E4A34AB04F24344394F870045A30173115545F4CCF6F20E922485494"},"header":{"backslash":"\\n    newParagraphElement = document.createElement(","elapsed":0.000015,"header":"\n    newParagraphElement = document.createElement("},"javascript":{"beautified":true,"elapsed":0.021487,"identifiers":["newParagraphElement","document","createElement","textLoremIpsum","createTextNode","appendChild","body"],"strings":["span","Lorem Ipsum"],"tokens":["Identifier","Punctuator","String"]},"yara":{"elapsed":0.000045,"matches":["test"]}}}

./strelka-oneshot -l - -f src/python/strelka/tests/fixtures/test.html
{"file":{"depth":0,"flavors":{"mime":["text/html"],"yara":["html_file"]},"scanners":["ScanEntropy","ScanFooter","ScanHash","ScanHeader","ScanHtml","ScanYara"],"size":5875,"tree":{"node":"489ddf43-48e4-499f-a537-da83adcd2c5a","root":"489ddf43-48e4-499f-a537-da83adcd2c5a"}},"request":{"attributes":{"filename":"src/python/strelka/tests/fixtures/test.html"},"client":"go-oneshot","id":"489ddf43-48e4-499f-a537-da83adcd2c5a","source":"ubuntu","time":1674328613},"scan":{"entropy":{"elapsed":0.000026,"entropy":4.847574566795829},"footer":{"backslash":"pan\u003e\u003c/span\u003e\\n\u003c/p\u003e\\n\\n\\n\u003cp\u003e\u0026nbsp;\u003c/p\u003e\\n\\n\\n\u003c/body\u003e\\n\u003c/html\u003e","elapsed":0.000016,"footer":"pan\u003e\u003c/span\u003e\n\u003c/p\u003e\n\n\n\u003cp\u003e\u0026nbsp;\u003c/p\u003e\n\n\n\u003c/body\u003e\n\u003c/html\u003e"},"hash":{"elapsed":0.000148,"md5":"ba4ffdba7f62b2333a23a97d3ba5f1f6","sha1":"a1f900c64ed49bc111462c6fd91546640b5ac20c","sha256":"38e2d4d56acf228fcebbbf5a60a16bb36ffcee490299ea52c9b1ffbcbeb62db8","ssdeep":"96:qWJQC5siJJ+tH6STSTSTSTkvsAw2gF3BgwQWhhSTSTSTSTS/sItklIy7STSTSTSh:qOQGsiJJO3eeeIvspjJPyeeeefklCeew","tlsh":"T14AC16713EF67021152BDA0E9E0BF4A64D494560CA3465BF4B2AE477ABFCD93136122CC"},"header":{"backslash":"\u003c!DOCTYPE html\u003e\\n\u003chtml lang=\"en\"\u003e\\n\u003chead\u003e\\n    \u003ctitle","elapsed":0.000014,"header":"\u003c!DOCTYPE html\u003e\n\u003chtml lang=\"en\"\u003e\n\u003chead\u003e\n    \u003ctitle"},"html":{"elapsed":0.004073,"scripts":[{"src":"https://example.com/example.js","type":"text/javascript"}],"spans":[{"style":"font-size:11pt"},{"style":"background-color:white"},{"style":"font-family:Calibri,sans-serif"},{"style":"font-size:52.5pt"},{"style":"color:black"},{"style":"font-size:12pt"},{"style":"font-family:\"Times New Roman\",serif"},{"style":"font-size:10.5pt"},{"style":"font-family:\"Arial\",sans-serif"}],"title":"Lorem Ipsum","total":{"extracted":1,"forms":0,"frames":0,"inputs":0,"scripts":2,"spans":35}},"yara":{"elapsed":0.000048,"matches":["test"]}}}
{"file":{"depth":1,"flavors":{"mime":["application/x-empty"]},"name":"script_1","scanners":["ScanEntropy","ScanFooter","ScanHash","ScanHeader","ScanYara"],"size":0,"source":"ScanHtml","tree":{"node":"af4d97b5-ac3b-48ad-aef2-5d914b5de5bc","parent":"489ddf43-48e4-499f-a537-da83adcd2c5a","root":"489ddf43-48e4-499f-a537-da83adcd2c5a"}},"request":{"attributes":{"filename":"src/python/strelka/tests/fixtures/test.html"},"client":"go-oneshot","id":"489ddf43-48e4-499f-a537-da83adcd2c5a","source":"ubuntu","time":1674328613},"scan":{"entropy":{"elapsed":0.000018,"entropy":0},"footer":{"elapsed":0.000013},"hash":{"elapsed":0.000054,"md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","ssdeep":"3::","tlsh":"TNULL"},"header":{"elapsed":0.000012},"yara":{"elapsed":0.000021,"matches":["test"]}}}
{"file":{"depth":1,"flavors":{"mime":["text/plain"],"yara":["javascript_file"]},"name":"script_1","scanners":["ScanEntropy","ScanFooter","ScanHash","ScanHeader","ScanJavascript","ScanYara"],"size":221,"source":"ScanHtml","tree":{"node":"59baf168-3fa5-4e2f-ae67-63a5f9e15903","parent":"489ddf43-48e4-499f-a537-da83adcd2c5a","root":"489ddf43-48e4-499f-a537-da83adcd2c5a"}},"request":{"attributes":{"filename":"src/python/strelka/tests/fixtures/test.html"},"client":"go-oneshot","id":"489ddf43-48e4-499f-a537-da83adcd2c5a","source":"ubuntu","time":1674328613},"scan":{"entropy":{"elapsed":0.000032,"entropy":4.620200029985679},"footer":{"backslash":"   document.body.appendChild(newParagraphElement)\\n","elapsed":0.000017,"footer":"   document.body.appendChild(newParagraphElement)\n"},"hash":{"elapsed":0.000058,"md5":"ed2a6dffc68bcbe361f4539b5f423d66","sha1":"172771134de76ede1df66cfa95a839237e485c40","sha256":"8c3e97cc7103eec2f8959b0f27e2011f09f26386131b075a59f2423c791917ff","ssdeep":"6:8/tuR78mgO9lV3K0Ji8mOFf0/tuRhBeJY1lLB/etuRMv:8/tuRYu80J17F8/tuRhBein2tuRu","tlsh":"T159D0A715143A07E4A34AB04F24344394F870045A30173115545F4CCF6F20E922485494"},"header":{"backslash":"\\n    newParagraphElement = document.createElement(","elapsed":0.000011,"header":"\n    newParagraphElement = document.createElement("},"javascript":{"beautified":true,"elapsed":0.001542,"identifiers":["newParagraphElement","document","createElement","textLoremIpsum","createTextNode","appendChild","body"],"strings":["span","Lorem Ipsum"],"tokens":["Identifier","Punctuator","String"]},"yara":{"elapsed":0.000033,"matches":["test"]}}}

Steps to reproduce

Run the same file through Strelka multiple times. The number of returned scanner events increases.

./strelka-oneshot -l - -f src/python/strelka/tests/fixtures/test.html | wc -l
2
./strelka-oneshot -l - -f src/python/strelka/tests/fixtures/test.html | wc -l
3
./strelka-oneshot -l - -f src/python/strelka/tests/fixtures/test.html | wc -l
4
./strelka-oneshot -l - -f src/python/strelka/tests/fixtures/test.html | wc -l
5

Expected behavior

./strelka-oneshot -l - -f src/python/strelka/tests/fixtures/test.html | wc -l
2
./strelka-oneshot -l - -f src/python/strelka/tests/fixtures/test.html | wc -l
2
./strelka-oneshot -l - -f src/python/strelka/tests/fixtures/test.html | wc -l
2
./strelka-oneshot -l - -f src/python/strelka/tests/fixtures/test.html | wc -l
2

Screenshots

Release

• Release: master/latest

Additional context

Strelka caches scanner objects for re-use. This is causing stale file objects to accumulate.