{"action":"created","comment":{"url":"https://api.github.com/repos/decalage2/oletools/pulls/comments/356835328","pull_request_review_id":330845005,"id":356835328,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDM1NjgzNTMyOA==","diff_hunk":"@@ -2627,8 +2627,11 @@ def __init__(self, filename, data=None, container=None, relaxed=False, encoding=\n             # and even whitespaces in between \"MIME\", \"-\", \"Version\" and \":\". The version number is ignored.\n             # And the line is case insensitive.\n             # so we'll just check the presence of mime, version and multipart anywhere:\n-            if self.type is None and b'mime' in data_lowercase and b'version' in data_lowercase \\\n-                and b'multipart' in data_lowercase:\n+            if (self.type is None and\n+                b'mime' in data_lowercase and\n+                b'version' in data_lowercase and\n+                b'multipart' in data_lowercase and\n+                abs(data_lowercase.index(b'version') - data_lowercase.index(b'mime')) < 20):","path":"oletools/olevba.py","position":55,"original_position":10,"commit_id":"0b9f0d5b34cc15b4e2d4df6a4b05d324eef3f24d","original_commit_id":"0b9f0d5b34cc15b4e2d4df6a4b05d324eef3f24d","user":{"login":"decalage2","id":5989656,"node_id":"MDQ6VXNlcjU5ODk2NTY=","avatar_url":"https://avatars1.githubusercontent.com/u/5989656?v=4","gravatar_id":"","url":"https://api.github.com/users/decalage2","html_url":"https://github.com/decalage2","followers_url":"https://api.github.com/users/decalage2/followers","following_url":"https://api.github.com/users/decalage2/following{/other_user}","gists_url":"https://api.github.com/users/decalage2/gists{/gist_id}","starred_url":"https://api.github.com/users/decalage2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/decalage2/subscriptions","organizations_url":"https://api.github.com/users/decalage2/orgs","repos_url":"https://api.github.com/users/decalage2/repos","events_url":"https://api.github.com/users/decalage2/events{/privacy}","received_events_url":"https://api.github.com/users/decalage2/received_events","type":"User","site_admin":false},"body":"Hi Kirk, do you have a sample where this was an issue?","created_at":"2019-12-11T21:10:36Z","updated_at":"2019-12-11T21:10:36Z","html_url":"https://github.com/decalage2/oletools/pull/319#discussion_r356835328","pull_request_url":"https://api.github.com/repos/decalage2/oletools/pulls/319","author_association":"OWNER","_links":{"self":{"href":"https://api.github.com/repos/decalage2/oletools/pulls/comments/356835328"},"html":{"href":"https://github.com/decalage2/oletools/pull/319#discussion_r356835328"},"pull_request":{"href":"https://api.github.com/repos/decalage2/oletools/pulls/319"}}},"pull_request":{"url":"https://api.github.com/repos/decalage2/oletools/pulls/319","id":193414409,"node_id":"MDExOlB1bGxSZXF1ZXN0MTkzNDE0NDA5","html_url":"https://github.com/decalage2/oletools/pull/319","diff_url":"https://github.com/decalage2/oletools/pull/319.diff","patch_url":"https://github.com/decalage2/oletools/pull/319.patch","issue_url":"https://api.github.com/repos/decalage2/oletools/issues/319","number":319,"state":"open","locked":false,"title":"Added support for using ControlTipText and Caption fields.","user":{"login":"kirk-sayre-work","id":29897701,"node_id":"MDQ6VXNlcjI5ODk3NzAx","avatar_url":"https://avatars2.githubusercontent.com/u/29897701?v=4","gravatar_id":"","url":"https://api.github.com/users/kirk-sayre-work","html_url":"https://github.com/kirk-sayre-work","followers_url":"https://api.github.com/users/kirk-sayre-work/followers","following_url":"https://api.github.com/users/kirk-sayre-work/following{/other_user}","gists_url":"https://api.github.com/users/kirk-sayre-work/gists{/gist_id}","starred_url":"https://api.github.com/users/kirk-sayre-work/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kirk-sayre-work/subscriptions","organizations_url":"https://api.github.com/users/kirk-sayre-work/orgs","repos_url":"https://api.github.com/users/kirk-sayre-work/repos","events_url":"https://api.github.com/users/kirk-sayre-work/events{/privacy}","received_events_url":"https://api.github.com/users/kirk-sayre-work/received_events","type":"User","site_admin":false},"body":"Added support for reading ControlTipText field from OleSiteConcreteControl.\r\n\r\nMade a small change to save the Caption text returned from consume_LabelControl in the dict returned from extract_OleFormVariables. A field for ControlTipText was also added to this dict.\r\n\r\nThis change was motivated by maldocs like 8882fb51cdbbd860ddaaabec98603a5f2dd700fdebabab12000202fc79cb609c .","created_at":"2018-06-07T18:48:54Z","updated_at":"2019-12-11T21:10:36Z","closed_at":null,"merged_at":null,"merge_commit_sha":"68e995c94020989b4c3e2be72300a85aa15b8f0d","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[{"id":380209161,"node_id":"MDU6TGFiZWwzODAyMDkxNjE=","url":"https://api.github.com/repos/decalage2/oletools/labels/:+1:%20enhancement","name":":+1: enhancement","color":"84b6eb","default":false,"description":""},{"id":942041504,"node_id":"MDU6TGFiZWw5NDIwNDE1MDQ=","url":"https://api.github.com/repos/decalage2/oletools/labels/oleform","name":"oleform","color":"46ad24","default":false,"description":""}],"milestone":{"url":"https://api.github.com/repos/decalage2/oletools/milestones/4","html_url":"https://github.com/decalage2/oletools/milestone/4","labels_url":"https://api.github.com/repos/decalage2/oletools/milestones/4/labels","id":2423125,"node_id":"MDk6TWlsZXN0b25lMjQyMzEyNQ==","number":4,"title":"oletools 0.5x","description":"Next changes planned for versions 0.5x","creator":{"login":"decalage2","id":5989656,"node_id":"MDQ6VXNlcjU5ODk2NTY=","avatar_url":"https://avatars1.githubusercontent.com/u/5989656?v=4","gravatar_id":"","url":"https://api.github.com/users/decalage2","html_url":"https://github.com/decalage2","followers_url":"https://api.github.com/users/decalage2/followers","following_url":"https://api.github.com/users/decalage2/following{/other_user}","gists_url":"https://api.github.com/users/decalage2/gists{/gist_id}","starred_url":"https://api.github.com/users/decalage2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/decalage2/subscriptions","organizations_url":"https://api.github.com/users/decalage2/orgs","repos_url":"https://api.github.com/users/decalage2/repos","events_url":"https://api.github.com/users/decalage2/events{/privacy}","received_events_url":"https://api.github.com/users/decalage2/received_events","type":"User","site_admin":false},"open_issues":136,"closed_issues":7,"state":"open","created_at":"2017-03-30T21:02:23Z","updated_at":"2019-11-29T20:50:35Z","due_on":null,"closed_at":null},"commits_url":"https://api.github.com/repos/decalage2/oletools/pulls/319/commits","review_comments_url":"https://api.github.com/repos/decalage2/oletools/pulls/319/comments","review_comment_url":"https://api.github.com/repos/decalage2/oletools/pulls/comments{/number}","comments_url":"https://api.github.com/repos/decalage2/oletools/issues/319/comments","statuses_url":"https://api.github.com/repos/decalage2/oletools/statuses/0b9f0d5b34cc15b4e2d4df6a4b05d324eef3f24d","head":{"label":"kirk-sayre-work:master","ref":"master","sha":"0b9f0d5b34cc15b4e2d4df6a4b05d324eef3f24d","user":{"login":"kirk-sayre-work","id":29897701,"node_id":"MDQ6VXNlcjI5ODk3NzAx","avatar_url":"https://avatars2.githubusercontent.com/u/29897701?v=4","gravatar_id":"","url":"https://api.github.com/users/kirk-sayre-work","html_url":"https://github.com/kirk-sayre-work","followers_url":"https://api.github.com/users/kirk-sayre-work/followers","following_url":"https://api.github.com/users/kirk-sayre-work/following{/other_user}","gists_url":"https://api.github.com/users/kirk-sayre-work/gists{/gist_id}","starred_url":"https://api.github.com/users/kirk-sayre-work/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kirk-sayre-work/subscriptions","organizations_url":"https://api.github.com/users/kirk-sayre-work/orgs","repos_url":"https://api.github.com/users/kirk-sayre-work/repos","events_url":"https://api.github.com/users/kirk-sayre-work/events{/privacy}","received_events_url":"https://api.github.com/users/kirk-sayre-work/received_events","type":"User","site_admin":false},"repo":{"id":136516285,"node_id":"MDEwOlJlcG9zaXRvcnkxMzY1MTYyODU=","name":"oletools","full_name":"kirk-sayre-work/oletools","private":false,"owner":{"login":"kirk-sayre-work","id":29897701,"node_id":"MDQ6VXNlcjI5ODk3NzAx","avatar_url":"https://avatars2.githubusercontent.com/u/29897701?v=4","gravatar_id":"","url":"https://api.github.com/users/kirk-sayre-work","html_url":"https://github.com/kirk-sayre-work","followers_url":"https://api.github.com/users/kirk-sayre-work/followers","following_url":"https://api.github.com/users/kirk-sayre-work/following{/other_user}","gists_url":"https://api.github.com/users/kirk-sayre-work/gists{/gist_id}","starred_url":"https://api.github.com/users/kirk-sayre-work/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kirk-sayre-work/subscriptions","organizations_url":"https://api.github.com/users/kirk-sayre-work/orgs","repos_url":"https://api.github.com/users/kirk-sayre-work/repos","events_url":"https://api.github.com/users/kirk-sayre-work/events{/privacy}","received_events_url":"https://api.github.com/users/kirk-sayre-work/received_events","type":"User","site_admin":false},"html_url":"https://github.com/kirk-sayre-work/oletools","description":"oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.","fork":true,"url":"https://api.github.com/repos/kirk-sayre-work/oletools","forks_url":"https://api.github.com/repos/kirk-sayre-work/oletools/forks","keys_url":"https://api.github.com/repos/kirk-sayre-work/oletools/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kirk-sayre-work/oletools/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kirk-sayre-work/oletools/teams","hooks_url":"https://api.github.com/repos/kirk-sayre-work/oletools/hooks","issue_events_url":"https://api.github.com/repos/kirk-sayre-work/oletools/issues/events{/number}","events_url":"https://api.github.com/repos/kirk-sayre-work/oletools/events","assignees_url":"https://api.github.com/repos/kirk-sayre-work/oletools/assignees{/user}","branches_url":"https://api.github.com/repos/kirk-sayre-work/oletools/branches{/branch}","tags_url":"https://api.github.com/repos/kirk-sayre-work/oletools/tags","blobs_url":"https://api.github.com/repos/kirk-sayre-work/oletools/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kirk-sayre-work/oletools/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kirk-sayre-work/oletools/git/refs{/sha}","trees_url":"https://api.github.com/repos/kirk-sayre-work/oletools/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kirk-sayre-work/oletools/statuses/{sha}","languages_url":"https://api.github.com/repos/kirk-sayre-work/oletools/languages","stargazers_url":"https://api.github.com/repos/kirk-sayre-work/oletools/stargazers","contributors_url":"https://api.github.com/repos/kirk-sayre-work/oletools/contributors","subscribers_url":"https://api.github.com/repos/kirk-sayre-work/oletools/subscribers","subscription_url":"https://api.github.com/repos/kirk-sayre-work/oletools/subscription","commits_url":"https://api.github.com/repos/kirk-sayre-work/oletools/commits{/sha}","git_commits_url":"https://api.github.com/repos/kirk-sayre-work/oletools/git/commits{/sha}","comments_url":"https://api.github.com/repos/kirk-sayre-work/oletools/comments{/number}","issue_comment_url":"https://api.github.com/repos/kirk-sayre-work/oletools/issues/comments{/number}","contents_url":"https://api.github.com/repos/kirk-sayre-work/oletools/contents/{+path}","compare_url":"https://api.github.com/repos/kirk-sayre-work/oletools/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kirk-sayre-work/oletools/merges","archive_url":"https://api.github.com/repos/kirk-sayre-work/oletools/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kirk-sayre-work/oletools/downloads","issues_url":"https://api.github.com/repos/kirk-sayre-work/oletools/issues{/number}","pulls_url":"https://api.github.com/repos/kirk-sayre-work/oletools/pulls{/number}","milestones_url":"https://api.github.com/repos/kirk-sayre-work/oletools/milestones{/number}","notifications_url":"https://api.github.com/repos/kirk-sayre-work/oletools/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kirk-sayre-work/oletools/labels{/name}","releases_url":"https://api.github.com/repos/kirk-sayre-work/oletools/releases{/id}","deployments_url":"https://api.github.com/repos/kirk-sayre-work/oletools/deployments","created_at":"2018-06-07T18:29:13Z","updated_at":"2019-12-11T18:54:06Z","pushed_at":"2019-12-11T18:54:03Z","git_url":"git://github.com/kirk-sayre-work/oletools.git","ssh_url":"git@github.com:kirk-sayre-work/oletools.git","clone_url":"https://github.com/kirk-sayre-work/oletools.git","svn_url":"https://github.com/kirk-sayre-work/oletools","homepage":"http://www.decalage.info/python/oletools","size":4260,"stargazers_count":2,"watchers_count":2,"language":"Rich Text Format","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":0,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":0,"open_issues":0,"watchers":2,"default_branch":"master"}},"base":{"label":"decalage2:master","ref":"master","sha":"5fb2d5c6cb9952f049520d56d6837e2d6c824947","user":{"login":"decalage2","id":5989656,"node_id":"MDQ6VXNlcjU5ODk2NTY=","avatar_url":"https://avatars1.githubusercontent.com/u/5989656?v=4","gravatar_id":"","url":"https://api.github.com/users/decalage2","html_url":"https://github.com/decalage2","followers_url":"https://api.github.com/users/decalage2/followers","following_url":"https://api.github.com/users/decalage2/following{/other_user}","gists_url":"https://api.github.com/users/decalage2/gists{/gist_id}","starred_url":"https://api.github.com/users/decalage2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/decalage2/subscriptions","organizations_url":"https://api.github.com/users/decalage2/orgs","repos_url":"https://api.github.com/users/decalage2/repos","events_url":"https://api.github.com/users/decalage2/events{/privacy}","received_events_url":"https://api.github.com/users/decalage2/received_events","type":"User","site_admin":false},"repo":{"id":59367670,"node_id":"MDEwOlJlcG9zaXRvcnk1OTM2NzY3MA==","name":"oletools","full_name":"decalage2/oletools","private":false,"owner":{"login":"decalage2","id":5989656,"node_id":"MDQ6VXNlcjU5ODk2NTY=","avatar_url":"https://avatars1.githubusercontent.com/u/5989656?v=4","gravatar_id":"","url":"https://api.github.com/users/decalage2","html_url":"https://github.com/decalage2","followers_url":"https://api.github.com/users/decalage2/followers","following_url":"https://api.github.com/users/decalage2/following{/other_user}","gists_url":"https://api.github.com/users/decalage2/gists{/gist_id}","starred_url":"https://api.github.com/users/decalage2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/decalage2/subscriptions","organizations_url":"https://api.github.com/users/decalage2/orgs","repos_url":"https://api.github.com/users/decalage2/repos","events_url":"https://api.github.com/users/decalage2/events{/privacy}","received_events_url":"https://api.github.com/users/decalage2/received_events","type":"User","site_admin":false},"html_url":"https://github.com/decalage2/oletools","description":"oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.","fork":false,"url":"https://api.github.com/repos/decalage2/oletools","forks_url":"https://api.github.com/repos/decalage2/oletools/forks","keys_url":"https://api.github.com/repos/decalage2/oletools/keys{/key_id}","collaborators_url":"https://api.github.com/repos/decalage2/oletools/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/decalage2/oletools/teams","hooks_url":"https://api.github.com/repos/decalage2/oletools/hooks","issue_events_url":"https://api.github.com/repos/decalage2/oletools/issues/events{/number}","events_url":"https://api.github.com/repos/decalage2/oletools/events","assignees_url":"https://api.github.com/repos/decalage2/oletools/assignees{/user}","branches_url":"https://api.github.com/repos/decalage2/oletools/branches{/branch}","tags_url":"https://api.github.com/repos/decalage2/oletools/tags","blobs_url":"https://api.github.com/repos/decalage2/oletools/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/decalage2/oletools/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/decalage2/oletools/git/refs{/sha}","trees_url":"https://api.github.com/repos/decalage2/oletools/git/trees{/sha}","statuses_url":"https://api.github.com/repos/decalage2/oletools/statuses/{sha}","languages_url":"https://api.github.com/repos/decalage2/oletools/languages","stargazers_url":"https://api.github.com/repos/decalage2/oletools/stargazers","contributors_url":"https://api.github.com/repos/decalage2/oletools/contributors","subscribers_url":"https://api.github.com/repos/decalage2/oletools/subscribers","subscription_url":"https://api.github.com/repos/decalage2/oletools/subscription","commits_url":"https://api.github.com/repos/decalage2/oletools/commits{/sha}","git_commits_url":"https://api.github.com/repos/decalage2/oletools/git/commits{/sha}","comments_url":"https://api.github.com/repos/decalage2/oletools/comments{/number}","issue_comment_url":"https://api.github.com/repos/decalage2/oletools/issues/comments{/number}","contents_url":"https://api.github.com/repos/decalage2/oletools/contents/{+path}","compare_url":"https://api.github.com/repos/decalage2/oletools/compare/{base}...{head}","merges_url":"https://api.github.com/repos/decalage2/oletools/merges","archive_url":"https://api.github.com/repos/decalage2/oletools/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/decalage2/oletools/downloads","issues_url":"https://api.github.com/repos/decalage2/oletools/issues{/number}","pulls_url":"https://api.github.com/repos/decalage2/oletools/pulls{/number}","milestones_url":"https://api.github.com/repos/decalage2/oletools/milestones{/number}","notifications_url":"https://api.github.com/repos/decalage2/oletools/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/decalage2/oletools/labels{/name}","releases_url":"https://api.github.com/repos/decalage2/oletools/releases{/id}","deployments_url":"https://api.github.com/repos/decalage2/oletools/deployments","created_at":"2016-05-21T15:37:49Z","updated_at":"2019-12-10T11:04:05Z","pushed_at":"2019-12-11T18:54:05Z","git_url":"git://github.com/decalage2/oletools.git","ssh_url":"git@github.com:decalage2/oletools.git","clone_url":"https://github.com/decalage2/oletools.git","svn_url":"https://github.com/decalage2/oletools","homepage":"http://www.decalage.info/python/oletools","size":4724,"stargazers_count":1013,"watchers_count":1013,"language":"Rich Text Format","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":267,"mirror_url":null,"archived":false,"disabled":false,"open_issues_count":269,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":267,"open_issues":269,"watchers":1013,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/decalage2/oletools/pulls/319"},"html":{"href":"https://github.com/decalage2/oletools/pull/319"},"issue":{"href":"https://api.github.com/repos/decalage2/oletools/issues/319"},"comments":{"href":"https://api.github.com/repos/decalage2/oletools/issues/319/comments"},"review_comments":{"href":"https://api.github.com/repos/decalage2/oletools/pulls/319/comments"},"review_comment":{"href":"https://api.github.com/repos/decalage2/oletools/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/decalage2/oletools/pulls/319/commits"},"statuses":{"href":"https://api.github.com/repos/decalage2/oletools/statuses/0b9f0d5b34cc15b4e2d4df6a4b05d324eef3f24d"}},"author_association":"NONE"}}
{"actor":{"display_login":"decalage2"}}