Use original file name when analysing

[Thorsten-Sick]

Use the "original" name and path of the file that is run in Cuckoo. To avoid detection of the analysis environment.

[michaelweiser]

I just had a look at the cuckoo submit code and there does not seem an option to pass a target for analysis while specifying an alternative name to use when placing it into the analysis environment. That'd mean we'd have to really give the file the original name in the local filesystem before submit, which, as @Jack28 explained in #81, is generally considered a bad idea because it means blindly using unvalidated/-able user input. Just think path traversal (../../../../../etc/passwd) or suchlike - whatever the actual exploit might be there.

With the REST API it's a different story: Since we're uploading the file content and name in a POST request, they're separate pieces of information which we could simply lie about: We'd still have our own temporary file named any odd way we like it to but when uploading to Cuckoo we should be able to put the original name from the mail attachment into the POST request (if available).

Need to look at an actual REST API /tasks/create/file POST request to verify and will report back.

[michaelweiser]

Okay, most everything was already in place and just needed the declared name exposed to it. Needs a bit more testing but should work nicely, IMO.

[michaelweiser]

Resolved by #84.