--newer is dangerous?
jeroenvermeulen opened this issue · 2 comments
jeroenvermeulen commented
If I understand it correct this can happen:
RULESURL=https://raw.githubusercontent.com/gwillem/magento-malware-scanner/master/build/all-confirmed.yar
RULEFILE=/var/cache/rules.yar
MAGENTO=/var/www/magento
- Monday 0:00 malware X exists in $MAGENTO
- Monday 0:00 malware X is not added to $RULESURL
- Monday 0:10
/usr/bin/curl -s $RULESURL -o $RULEFILE
- Monday 0:11
mwscan --newonly --rules $RULEFILE $MAGENTO
=> malware X not found - Monday 10:00 @gwillem adds a malware X to $RULESURL
- Tuesday 0:10
/usr/bin/curl -s $RULESURL -o $RULEFILE
- Tuesday 0:11
mwscan --newonly --rules $RULEFILE $MAGENTO
=> malware X not found
This is a problem right?
Or am I missing something?
A possible fix would be to add the version of the all-confirmed.yar
to the path of the LAST_RUN_FILE
gwillem commented
Well spotted! However, the newer_than function signature is not used anymore (for the reason you state), I shall remove it. --newonly
will just ignore infections found in last run, so your scenario mentioned above won't happen.
gwillem commented
PS. Instead of using curl
you can also use mwscan -s byte
(or another ruleset) which will download it for you.