You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2006/07/10 14:14:22 UTC

[Bug 2977] RFE: large messages should have first half scanned

http://issues.apache.org/SpamAssassin/show_bug.cgi?id=2977


jm@jmason.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|RFE: improve spamc message  |RFE: large messages should
                   |size limit                  |have first half scanned




------- Additional Comments From jm@jmason.org  2006-07-10 12:14 -------
btw, thinking about this; it's actually pretty trivial for a MIME-structured
HTML message to contain 300KB of innocuous-looking body text, then 5KB of
"payload" HTML.  on scan, SA would scan the first 250KB and it'd all look
innocuous; however, on display, the 5KB would use DOM or CSS tricks to "overlay"
the payload in place of the decoy text.

I'm not sure this suggestion is viable as a result, since it's vulnerable to
this evasion.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.