You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2015/04/15 15:22:46 UTC
[Bug 7174] New: Mail triggers false positives in rules PYZOR_CHECK
and TVD_SPACE_RATIO_MINFP
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7174
Bug ID: 7174
Summary: Mail triggers false positives in rules PYZOR_CHECK and
TVD_SPACE_RATIO_MINFP
Product: Spamassassin
Version: unspecified
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Rules
Assignee: dev@spamassassin.apache.org
Reporter: hanno@hboeck.de
Created attachment 5298
--> https://bz.apache.org/SpamAssassin/attachment.cgi?id=5298&action=edit
mail triggering false positives
A customer asked me why the mail I'll attach was flagged as spam by
spamassassin.
I looked at the rules it triggers:
0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail
domains are different
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail
provider
(ursus.schommer[at]gmx.de)
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no
trust
[212.227.15.15 listed in list.dnswl.org]
-0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
[212.227.15.15 listed in wl.mailspike.net]
1.1 MIME_HTML_ONLY BODY: Message only has text/html MIME parts
0.0 HTML_MESSAGE BODY: HTML included in message
2.0 PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/)
0.2 FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom
freemail headers are different
0.0 TVD_SPACE_RATIO No description available.
2.7 TVD_SPACE_RATIO_MINFP No description available.
Two things stand out here: PYZOR_CHECK and TVD_SPACE_RATIO_MINFP.
When I manually check the mail with "pyzor check < [mail]" it shows me the mail
as 200/OK. So it seems spamassassin does something wrong in the pyzor check.
The TVD_SPACE_RATIO_MINFP is supposed to flag mails with a high rate of spaces
versus non-spaces. However the mail content doesn't contain any spaces. (Guess:
Maybe the fact that it's html only causes the rule to fail this way.)
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7174] Mail triggers false positives in rules PYZOR_CHECK and
TVD_SPACE_RATIO_MINFP
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7174
Kevin A. McGrail <km...@pccc.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |kmcgrail@pccc.com
--- Comment #1 from Kevin A. McGrail <km...@pccc.com> ---
I added a quick debug and you are hitting the TVD_vertical_words percentage.
DEBUG: 5 / 0 / 10
print "DEBUG: $pms->{tvd_vertical_words} / $min / $max\n";
return 1 if ($pms->{tvd_vertical_words} >= $min && $pms->{tvd_vertical_words}
< $max);
Can't comment on pyzor as I don't use it, though.
Might want to look at lowering your local score on TVD_SPACE_RATIO_MINFP.
John, you've worked on this rule before, any comments?
KAM
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7174] Mail triggers false positives in rules PYZOR_CHECK and
TVD_SPACE_RATIO_MINFP
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7174
Kevin A. McGrail <km...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |FIXED
--- Comment #4 from Kevin A. McGrail <km...@apache.org> ---
Considering resolved after 3 years.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7174] Mail triggers false positives in rules PYZOR_CHECK and
TVD_SPACE_RATIO_MINFP
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7174
--- Comment #3 from Kevin A. McGrail <km...@pccc.com> ---
I added a small debug to research this more: svn commit -m 'Added a debug for
tvd_vertical_words'
Sending lib/Mail/SpamAssassin/Plugin/BodyEval.pm
Transmitting file data .
Committed revision 1673960.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7174] Mail triggers false positives in rules PYZOR_CHECK and
TVD_SPACE_RATIO_MINFP
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7174
John Hardin <jh...@impsec.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |jhardin@impsec.org
--- Comment #2 from John Hardin <jh...@impsec.org> ---
(In reply to Kevin A. McGrail from comment #1)
>
> John, you've worked on this rule before, any comments?
I only added the MINFP part, meta'ing the base TVD_SPACE_RATIO rule with some
ham-only exclusion rules to reduce FPs. The base behavior of the
TVD_SPACE_RATIO isn't something I've worked on and am not really familiar with.
I'm surprised that rule even hits. There's almost no body content, just one
word with some HTML markup on a single line, and the MIME warning. How is it
detecting *any* "vertical words"?
--
You are receiving this mail because:
You are the assignee for the bug.