You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Michael Scheidell <sc...@secnap.net> on 2010/05/04 16:40:28 UTC
should a BLANK subject be the same as missing subject?
Have an email, Subject: header exists, but is blank (not even a space
after the :) but the MISSING_SUBJECT rule does not trigger.
should it? I have seen a couple of these in the past. so far, all spam.
(running sa 3.3.1 with latest rules)
it triggers ,__HAS_SUBJECT,_ so, it won't trigger MISSING_SUBJECT
20_head_tests.cf:header __HAS_SUBJECT exists:Subject
20_head_tests.cf:meta MISSING_SUBJECT !__HAS_SUBJECT
(remember, it has a Subject: header, but no content)
If I remember correctly, in < 3.3 the compares matched if it was blank,
vs NULL.
this one is blank, and NOT NULL.
(eg: 3.2, a blank header would look like no header at all in 3.2)
--
Michael Scheidell, CTO
Phone: 561-999-5000, x 1259
> *| *SECNAP Network Security Corporation
* Certified SNORT Integrator
* 2008-9 Hot Company Award Winner, World Executive Alliance
* Five-Star Partner Program 2009, VARBusiness
* Best Anti-Spam Product 2008, Network Products Guide
* King of Spam Filters, SC Magazine 2008
______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________
Re: should a BLANK subject be the same as missing subject?
Posted by Mark Martinec <Ma...@ijs.si>.
On Tuesday 04 May 2010 16:40:28 Michael Scheidell wrote:
> Have an email, Subject: header exists, but is blank (not even a space
> after the :) but the MISSING_SUBJECT rule does not trigger.
> should it? I have seen a couple of these in the past. so far, all spam.
> (running sa 3.3.1 with latest rules)
>
> it triggers ,__HAS_SUBJECT,_ so, it won't trigger MISSING_SUBJECT
> 20_head_tests.cf:header __HAS_SUBJECT exists:Subject
> 20_head_tests.cf:meta MISSING_SUBJECT !__HAS_SUBJECT
>
>
> (remember, it has a Subject: header, but no content)
> If I remember correctly, in < 3.3 the compares matched if it was blank,
> vs NULL.
> this one is blank, and NOT NULL.
> (eg: 3.2, a blank header would look like no header at all in 3.2)
That distinction was indeed introduced with 3.3. Previously it was not
possible to distinguish an absent header field from a header field
with an empty body.
The MISSING_SUBJECT rule now reflects its name and purpose better IMO.
If a rule such as EMPTY_SUBJECT turns out to be useful, it should be
added as a separate rule with its own score, something like:
header EMPTY_SUBJECT Subject =~ /^\s*$/
score EMPTY_SUBJECT 0.5
Mark