You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "Eric A. Hall" <eh...@ehsco.com> on 2005/07/10 19:48:01 UTC
messages with no body
Anybody got a rule that will catch messages that don't have a body?
--
Eric A. Hall http://www.ehsco.com/
Internet Core Protocols http://www.oreilly.com/catalog/coreprot/
Re: messages with no body
Posted by "Eric A. Hall" <eh...@ehsco.com>.
On 7/12/2005 8:59 PM, Loren Wilton wrote:
> Note that in business circles "content" includes the subject. As far
> as I know, rawbody won't see a subject. It is fairly common to send
> one line questions in the subject with an empty body, and one line
> replies likewise.
I have trained my users better than that, which is why I don't care about
these tests. Other people might tho.
--
Eric A. Hall http://www.ehsco.com/
Internet Core Protocols http://www.oreilly.com/catalog/coreprot/
Re: messages with no body
Posted by Loren Wilton <lw...@earthlink.net>.
> header __L_MSG_HAS_C_TYPE_M Content-Type =~ /^(message|multipart)/i
> rawbody __L_MSG_HAS_BODY /\S/
>
> describe L_MSG_NO_BODY Raw message does not have any body data
> meta L_MSG_NO_BODY (!__L_MSG_C_TYPE_M && !__L_MSG_BODY)
> score L_MSG_NO_BODY 0.1
>
> BTW, I am doing this so that postfix can trap the rule after the message
> has undergone filtering, so that the message can simply be rejected
> (there's no judgement as to spamminess here, just a check to see if the
> message has any content).
Note that in business circles "content" includes the subject. As far as I
know, rawbody won't see a subject. It is fairly common to send one line
questions in the subject with an empty body, and one line replies likewise.
Your rule would dump these mails, which is why the versions I wrote of this
would check for lack of body, subject, and to. If you don't have a body and
you don't have a subject there isn't much content. If you don't have a to,
then it is pretty useless. But just lacking a body isn't imho sufficient to
conclude "content-less".
Loen
Re: messages with no body
Posted by "Eric A. Hall" <eh...@ehsco.com>.
On 7/10/2005 4:41 PM, Eric A. Hall wrote:
> On 7/10/2005 3:49 PM, Loren Wilton wrote:
>
>>However, if you want something like this, just off the top of my head:
>>
>>header __HAS_TO To =~/\S/
>>body __HAS_BODY /\S/
>>meta EMPTY_MSG (!__HAS_TO && !__HAS_BODY)
>
> Good idea. rawbody works better but the model is right.
As was pointed out off-list, this rule will wrongly fire if there is an
attachment and no text body. The following rule is adapted from the
suggested rules that were provided (I assume anonymity was desired from
the off-list response so...). The rule checks for the presence of a nested
media-type (message/ and multipart/ are the only nested types) or the
presence of body data.
header __L_MSG_HAS_C_TYPE_M Content-Type =~ /^(message|multipart)/i
rawbody __L_MSG_HAS_BODY /\S/
describe L_MSG_NO_BODY Raw message does not have any body data
meta L_MSG_NO_BODY (!__L_MSG_C_TYPE_M && !__L_MSG_BODY)
score L_MSG_NO_BODY 0.1
There are lots of fancier things to look for but that is pretty minimal
testing which is what I'm looking for.
BTW, I am doing this so that postfix can trap the rule after the message
has undergone filtering, so that the message can simply be rejected
(there's no judgement as to spamminess here, just a check to see if the
message has any content).
--
Eric A. Hall http://www.ehsco.com/
Internet Core Protocols http://www.oreilly.com/catalog/coreprot/
Re: messages with no body
Posted by "Eric A. Hall" <eh...@ehsco.com>.
On 7/10/2005 4:56 PM, Loren Wilton wrote:
> Rawbody will miss the subject, so you will need to add a test for that too.
I'm not looking for that
--
Eric A. Hall http://www.ehsco.com/
Internet Core Protocols http://www.oreilly.com/catalog/coreprot/
Re: messages with no body
Posted by Loren Wilton <lw...@earthlink.net>.
Rawbody will miss the subject, so you will need to add a test for that too.
Loren
Re: messages with no body
Posted by "Eric A. Hall" <eh...@ehsco.com>.
On 7/10/2005 3:49 PM, Loren Wilton wrote:
> However, if you want something like this, just off the top of my head:
>
> header __HAS_TO To =~/\S/
> body __HAS_BODY /\S/
> meta EMPTY_MSG (!__HAS_TO && !__HAS_BODY)
Good idea. rawbody works better but the model is right.
--
Eric A. Hall http://www.ehsco.com/
Internet Core Protocols http://www.oreilly.com/catalog/coreprot/
Re: messages with no body
Posted by Loren Wilton <lw...@earthlink.net>.
> I guess I should have asked the obvious question:
>
> "and if so, could you post it?"
Well, I'd hoped that the 'draconian' would detract from that idea. But
since you ask anyway, I went looking. And discovered that I *don't* have a
rule for this anymore! I'm just getting by on the SARE rules augmented by
Fred's rules.
However, if you want something like this, just off the top of my head:
header __HAS_TO To =~/\S/
body __HAS_BODY /\S/
meta EMPTY_MSG (!__HAS_TO && !__HAS_BODY)
Loren
Re: messages with no body
Posted by "Eric A. Hall" <eh...@ehsco.com>.
On 7/10/2005 3:12 PM, Loren Wilton wrote:
>>> Anybody got a rule that will catch messages that don't have a body?
>>>
>
> There are things like that around. I have a rather draconian pesonal
> rule I use. There is a much milder form in one of the SARE rulesets.
> The problem is you can't check just missing body, as you will get way
> too many FPs in a business environment.
I guess I should have asked the obvious question:
"and if so, could you post it?"
thanks
--
Eric A. Hall http://www.ehsco.com/
Internet Core Protocols http://www.oreilly.com/catalog/coreprot/
Re: messages with no body
Posted by Loren Wilton <lw...@earthlink.net>.
> This brings up a question. Why are these sent out? To validate addresses
> perhaps?
Virtually all of the ones I see typically also lack either or both of a
subject and a To: address. They very typically have some header information
mangled also.
My belief is that one of the spammer tools (I have no idea which one, never
having looked at that stuff) is perhaps not the easiest for boneheads to use
completely without thought, and if you misconfigure it, you end up with a
run of blank spam.
I suppose this could be a simple 'ping' test to make sure your spam sending
network is working after reconfiguration, and before seinding something for
a paying customer. I think its more likely that it is just a stupid
misconfiguration though.
> > Anybody got a rule that will catch messages that don't have a body?
There are things like that around. I have a rather draconian pesonal rule I
use. There is a much milder form in one of the SARE rulesets. The problem
is you can't check just missing body, as you will get way too many FPs in a
business environment.
Loren
Re: messages with no body
Posted by Rob Skedgell <ro...@nephelococcygia.demon.co.uk>.
On Sunday 10 Jul 2005 19:00, qqqq wrote:
> This brings up a question. Why are these sent out? To validate
> addresses perhaps?
B0rked malware infestations?
--
Rob Skedgell <ro...@nephelococcygia.demon.co.uk>
Re: messages with no body
Posted by qqqq <qq...@usermail.com>.
This brings up a question. Why are these sent out? To validate addresses
perhaps?
QQQQ
----- Original Message -----
From: "Eric A. Hall" <eh...@ehsco.com>
To: <us...@spamassassin.apache.org>
Sent: Sunday, July 10, 2005 11:48 AM
Subject: messages with no body
>
> Anybody got a rule that will catch messages that don't have a body?
>
> --
> Eric A. Hall http://www.ehsco.com/
> Internet Core Protocols http://www.oreilly.com/catalog/coreprot/
>
>