You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Bogdan Ćulibrk <bc...@default.rs> on 2009/03/23 10:52:31 UTC
warn: util: cannot untaint path: "ARRAY(0x8819ebc)"
Hi spamassassin-users,
I'm trying to make use of Mail::SpamAssassin::Plugin::AccessDB plugin.
This is what I have in config:
body GMAIL_IZDANJA eval:check_access_database('/etc/mail/gmail_spam.db')
describe GMAIL_IZDANJA spam from gmail.com
score GMAIL_IZDANJA 35.000
Content of /etc/mail/gmail_spam is in format "email@addr REJECT". File
is compiled with postmap and exim_dbmbuild, both didn't work.
When I do spamassassin --lint I get this:
[18199] warn: util: cannot untaint path: "ARRAY(0x8819ebc)"
I successuly reproduced bug on two systems:
FreeBSD/i386 7.0, Perl 5.8.9 (ports), SpamAssassin-3.2.5_1 (ports)
Debian Lenny, Perl 5.10.0, spamassassin 3.2.5-2
I've checked arhives, but nothing. I would be happy with someone's pointer.
Thanks,
Bogdan
Re: warn: util: cannot untaint path: "ARRAY(0x8819ebc)"
Posted by Mark Martinec <Ma...@ijs.si>.
Martin Gregorie wrote:
> OTOH I have a similar plot. The idea is that mail from an exact address
> that I've previously sent mail to will not be spam. My system consists
> of two parts:
>
> - the first automatically records every address I've sent mail to.
> This uses a table in a PostgreSQL database which contains the
> address and a manually set flag to to show whether the address is
> within one of my domains.
>
> - the second part is an SA plugin and a rule. The plugin checks
> whether an email's sender address matches the database and is not
> one of my marked addresses. If this condition is met the email is
> whitelisted.
>
> The 'my domain' flag is needed to weed out cases where the sender
> address is forged using a valid address in my domain. I only filter
> incoming mail: this would not work if I filtered internal mail.
>
> I built the plugin by modifying the SentOutDB.pm plugin from
> http://whatever.frukt.org/mdf-sentoutdb.text.shtml
Yes, this is a useful techniques to cut down false positives.
It was introduced with amavisd-new-2.4.2 (June 2006), the feature
is known as 'pen pals'. Initially it only dealt with envelope sender
and recipient address pairs, but was later extended to take into
account a Message-ID, References and In-Reply-To header fields,
which extended its usefulness to mailing list threads.
From release notes:
- new feature: "pen pals soft-whitelisting" lowers spam score of received
replies (or followup correspondence) to a message previously sent by a
local user to this address;
How it works:
* SQL logging stores records about all mail messages processed by amavisd,
their sender, recipients, delivery status, mail contents type (no changes
there, this feature was introduced with amavisd-new-2.3.0); for the
purpose of pen pals scheme only records with local-domain senders matter;
* when a message is received, a SQL lookup against a SQL logging database
is performed, looking for previous messages sent in reverse direction,
i.e. from a local user (which is now a recipient of the current mail)
to the address that is now the sender of the message being processed;
A SELECT clause in $sql_clause{'sel_penpals'} is used, which by default
only considers records of previous messages that were actually
delivered (not rejected, discarded or bounced), and were not infected.
SQL lookup returns a timestamp of the most recent such message (if any),
the difference (in seconds) between the current time and the timestamp
is an 'age' as used in the following formula;
* an exponential decay formula calculates score points to be deducted
from the SA score:
weight = 1 / 2^(age/penpals_halflife)
score_boost = -penpals_bonus_score * weight
i.e. penpals_bonus_score is multiplied by 1, 1/2, 1/4, 1/8, 1/16, ...
at age 0, 1*halflife, 2*halflife, 3*halflife, 4*halflife ...
weight is a continuous function of age (actually, in steps of one second);
Mark
Re: warn: util: cannot untaint path: "ARRAY(0x8819ebc)"
Posted by Martin Gregorie <ma...@gregorie.org>.
On Mon, 2009-03-23 at 15:44 +0100, Ivan Savcic wrote:
> The goal is to put the regexes, which are being searched for in the
> body of the mail, out of the configuration file, to avoid clutter and
> to allow easy addition of new regexes.
>
But have you got a plot for compiling the regexes when they've been
retrieved?
OTOH I have a similar plot. The idea is that mail from an exact address
that I've previously sent mail to will not be spam. My system consists
of two parts:
- the first automatically records every address I've sent mail to.
This uses a table in a PostgreSQL database which contains the
address and a manually set flag to to show whether the address is
within one of my domains.
- the second part is an SA plugin and a rule. The plugin checks
whether an email's sender address matches the database and is not
one of my marked addresses. If this condition is met the email is
whitelisted.
The 'my domain' flag is needed to weed out cases where the sender
address is forged using a valid address in my domain. I only filter
incoming mail: this would not work if I filtered internal mail.
I built the plugin by modifying the SentOutDB.pm plugin from
http://whatever.frukt.org/mdf-sentoutdb.text.shtml
Martin
Re: warn: util: cannot untaint path: "ARRAY(0x8819ebc)"
Posted by Benny Pedersen <me...@junc.org>.
On Thu, March 26, 2009 10:57, Bogdan ?ulibrk wrote:
> "hi m8, here is Bob's email I've mentioned you on today on coffee
> break mailto:bob@yahoo.com".
gmail uses dkim/spf so whitelist users based on it
freemail hit, but scores default 0.5, and only score more if in body
or reply-to use another email
--
http://localhost/ 100% uptime and 100% mirrored :)
RE: warn: util: cannot untaint path: "ARRAY(0x8819ebc)"
Posted by Giampaolo Tomassoni <g....@libero.it>.
> -----Original Message-----
> From: Bogdan Ćulibrk [mailto:bc@default.rs]
> Sent: Thursday, March 26, 2009 10:58 AM
>
> McDonald, Dan wrote:
> > On Mon, 2009-03-23 at 15:44 +0100, Ivan Savcic wrote:
> >> On Mon, Mar 23, 2009 at 3:08 PM, Mark Martinec
> <Ma...@ijs.si> wrote:
> >>> Bogdan,
> >>>
> >>>>> The test is supposed to receive a header as argument, not a body:
> >>>> thanks for the reply. What I am trying to do is actually have
> access map
> >>>> of blacklisted email addresses or websites that are mentioned in
> the
> >>>> *body* of email, not in header.
> >
> > have you looked at the freemail plugin? It might give you some ideas
> > how to do what you want.
> >
> >
>
> Hello,
>
> thanks for pointer, but here's one question: wouldn't this plugin give
> false positive on scenario where corresponding with legitimate
> user@gmail.com that mentions some other gmail email in manner:
>
> "hi m8, here is Bob's email I've mentioned you on today on coffee break
> mailto:bob@yahoo.com".
Right, of course: it would fire both FREEMAIL_FROM and FREEMAIL_REPLYTO, contributing for 2.5 points to the message's score.
So what? The message would pass untouched if no other rule fires...
Most of the SA rules and plugins are meant to give their own contribution in identifying spam, not each one acting as a rude knife.
Some rule fire on very legit messages, by the way...
Giampaolo
> Thanks,
> Bogdan
Re: warn: util: cannot untaint path: "ARRAY(0x8819ebc)"
Posted by Bogdan Ćulibrk <bc...@default.rs>.
McDonald, Dan wrote:
> On Mon, 2009-03-23 at 15:44 +0100, Ivan Savcic wrote:
>> On Mon, Mar 23, 2009 at 3:08 PM, Mark Martinec <Ma...@ijs.si> wrote:
>>> Bogdan,
>>>
>>>>> The test is supposed to receive a header as argument, not a body:
>>>> thanks for the reply. What I am trying to do is actually have access map
>>>> of blacklisted email addresses or websites that are mentioned in the
>>>> *body* of email, not in header.
>
> have you looked at the freemail plugin? It might give you some ideas
> how to do what you want.
>
>
Hello,
thanks for pointer, but here's one question: wouldn't this plugin give
false positive on scenario where corresponding with legitimate
user@gmail.com that mentions some other gmail email in manner:
"hi m8, here is Bob's email I've mentioned you on today on coffee break
mailto:bob@yahoo.com".
Thanks,
Bogdan
Re: warn: util: cannot untaint path: "ARRAY(0x8819ebc)"
Posted by "McDonald, Dan" <Da...@austinenergy.com>.
On Mon, 2009-03-23 at 15:44 +0100, Ivan Savcic wrote:
> On Mon, Mar 23, 2009 at 3:08 PM, Mark Martinec <Ma...@ijs.si> wrote:
> > Bogdan,
> >
> >> > The test is supposed to receive a header as argument, not a body:
> >
> >> thanks for the reply. What I am trying to do is actually have access map
> >> of blacklisted email addresses or websites that are mentioned in the
> >> *body* of email, not in header.
have you looked at the freemail plugin? It might give you some ideas
how to do what you want.
--
Daniel J McDonald, CCIE #2495, CISSP #78281, CNX
Austin Energy
http://www.austinenergy.com
Re: warn: util: cannot untaint path: "ARRAY(0x8819ebc)"
Posted by Ivan Savcic <is...@gmail.com>.
On Mon, Mar 23, 2009 at 3:08 PM, Mark Martinec <Ma...@ijs.si> wrote:
> Bogdan,
>
>> > The test is supposed to receive a header as argument, not a body:
>
>> thanks for the reply. What I am trying to do is actually have access map
>> of blacklisted email addresses or websites that are mentioned in the
>> *body* of email, not in header.
>
> I'm afraid you'd need to enhance the plugin to do what you want.
> The current AccessDB only checks sender/author addresses from the
> header section. Actually it seems you want a cross between some
> URI* plugin and AccessDB.
>
> Perhaps a way out is to set up your own local RBL zone in your
> DNS server, stock it up with the contents of your access database,
> then let it be used by URI rules.
>
> Mark
The goal is to put the regexes, which are being searched for in the
body of the mail, out of the configuration file, to avoid clutter and
to allow easy addition of new regexes. Unfortunately, mailto: links
cannot be put in a RBL, at least not in
their native form.
In other words, what we use currently is:
body __GMAIL_IZDANJA_BODY /email\@address\.com/i
We combine that rule in a meta with a few other rules and assign a
score to it. Is there a way to put all the email addresses we are
searching for in the body of the messages in a separate file or a
database and not specify them in the configuration file directly?
Thanks,
--
Ivan Savcic
isavcic at gmail . com
Re: warn: util: cannot untaint path: "ARRAY(0x8819ebc)"
Posted by Mark Martinec <Ma...@ijs.si>.
Bogdan,
> > The test is supposed to receive a header as argument, not a body:
> thanks for the reply. What I am trying to do is actually have access map
> of blacklisted email addresses or websites that are mentioned in the
> *body* of email, not in header.
I'm afraid you'd need to enhance the plugin to do what you want.
The current AccessDB only checks sender/author addresses from the
header section. Actually it seems you want a cross between some
URI* plugin and AccessDB.
Perhaps a way out is to set up your own local RBL zone in your
DNS server, stock it up with the contents of your access database,
then let it be used by URI rules.
Mark
Re: warn: util: cannot untaint path: "ARRAY(0x8819ebc)"
Posted by Bogdan Ćulibrk <bc...@default.rs>.
Mark Martinec wrote:
> Bogdan,
>
>> I'm trying to make use of Mail::SpamAssassin::Plugin::AccessDB plugin.
>> This is what I have in config:
>>
>> body GMAIL_IZDANJA eval:check_access_database('/etc/mail/gmail_spam.db')
>> describe GMAIL_IZDANJA spam from gmail.com
>> score GMAIL_IZDANJA 35.000
>>
>> Content of /etc/mail/gmail_spam is in format "email@addr REJECT". File
>> is compiled with postmap and exim_dbmbuild, both didn't work.
>>
>> When I do spamassassin --lint I get this:
>> [18199] warn: util: cannot untaint path: "ARRAY(0x8819ebc)"
>
> The test is supposed to receive a header as argument, not a body:
>
> wrong:
> body GMAIL_IZDANJA eval:check_access_database('/etc/mail/gmail_spam.db')
>
> right:
> header GMAIL_IZDANJA eval:check_access_database('/etc/mail/gmail_spam.db')
>
>
> Mark
Hi Mark,
thanks for the reply. What I am trying to do is actually have access map
of blacklisted email addresses or websites that are mentioned in the
*body* of email, not in header.
Best,
Bogdan
Re: warn: util: cannot untaint path: "ARRAY(0x8819ebc)"
Posted by Mark Martinec <Ma...@ijs.si>.
Bogdan,
> I'm trying to make use of Mail::SpamAssassin::Plugin::AccessDB plugin.
> This is what I have in config:
>
> body GMAIL_IZDANJA eval:check_access_database('/etc/mail/gmail_spam.db')
> describe GMAIL_IZDANJA spam from gmail.com
> score GMAIL_IZDANJA 35.000
>
> Content of /etc/mail/gmail_spam is in format "email@addr REJECT". File
> is compiled with postmap and exim_dbmbuild, both didn't work.
>
> When I do spamassassin --lint I get this:
> [18199] warn: util: cannot untaint path: "ARRAY(0x8819ebc)"
The test is supposed to receive a header as argument, not a body:
wrong:
body GMAIL_IZDANJA eval:check_access_database('/etc/mail/gmail_spam.db')
right:
header GMAIL_IZDANJA eval:check_access_database('/etc/mail/gmail_spam.db')
Mark