Re: Rule to score word documents

[Alex <my...@gmail.com>]

Hi,

David Funk wrote:
>>> /^(Content-(Type|Disposition)\:|[[:space:]]+).*(file)?name="?.*\.doc"?;?$/
>>>
>>> REJECT
>>>
>>> I believe something like this would work in spamassassin:
>>>
>>> mimeheader DOC_ATTACHED Content-Type =~ /="[^"]+\.(?:docx?|rtf)"/i
>>> score            DOC_ATTACHED 12.5
>>
>> This may catch some documents but MS products key almost entirely on the
>> file name extension.
>>
>> So the content type header may be "application/octet-stream" and totally
>> missing a 'name=' component but if there's also a Content-Disposition
>> header that has a 'filename=' component it will trigger file opening
>> behaivor.

Are you suggesting another regex for postfix is necessary? If so,
please provide an example.

Robert Schetterer wrote:
> just found
>
> https://github.com/sbidy/MacroMilter

This looks to be helpful for users who don't already have clamav,
correct? It otherwise looks to duplicate only a portion of clamav's
capability.

Thanks,
Alex