svn commit: r553392 - in /spamassassin: rules/trunk/sandbox/felicity/70_other.cf trunk/lib/Mail/SpamAssassin/Message.pm trunk/lib/Mail/SpamAssassin/Plugin/MIMEEval.pm

[fe...@apache.org]

Author: felicity
Date: Wed Jul  4 23:44:24 2007
New Revision: 553392

URL: http://svn.apache.org/viewvc?view=rev&rev=553392
Log:
Put in a new rule that looks for MIME eplilogues (data after the closing
boundary).  It's a really quick thing to test for, and has an ok hit rate in
my testing, so ...


Modified:
    spamassassin/rules/trunk/sandbox/felicity/70_other.cf
    spamassassin/trunk/lib/Mail/SpamAssassin/Message.pm
    spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/MIMEEval.pm

Modified: spamassassin/rules/trunk/sandbox/felicity/70_other.cf
URL: http://svn.apache.org/viewvc/spamassassin/rules/trunk/sandbox/felicity/70_other.cf?view=diff&rev=553392&r1=553391&r2=553392
==============================================================================
--- spamassassin/rules/trunk/sandbox/felicity/70_other.cf (original)
+++ spamassassin/rules/trunk/sandbox/felicity/70_other.cf Wed Jul  4 23:44:24 2007
@@ -274,6 +274,9 @@
 body BASE64_LENGTH_78_79	eval:check_base64_length('78','79')
 body BASE64_LENGTH_79_INF	eval:check_base64_length('79')
 
+# 0.177   0.2037   0.0000    1.000   0.00    0.00  TVD_MIME_EPI
+body TVD_MIME_EPI	eval:check_mime_epilogue()
+
 endif
 
 # these don't have a large enough hitrate to be real rules, but it may be

Modified: spamassassin/trunk/lib/Mail/SpamAssassin/Message.pm
URL: http://svn.apache.org/viewvc/spamassassin/trunk/lib/Mail/SpamAssassin/Message.pm?view=diff&rev=553392&r1=553391&r2=553392
==============================================================================
--- spamassassin/trunk/lib/Mail/SpamAssassin/Message.pm (original)
+++ spamassassin/trunk/lib/Mail/SpamAssassin/Message.pm Wed Jul  4 23:44:24 2007
@@ -834,6 +834,19 @@
     push ( @{$part_array}, $_ );
   }
 
+  # Look for a message epilogue
+  # originally ignored whitespace:   0.185   0.2037   0.0654    0.757   0.00   0.00  TVD_TAB
+  # ham FPs were all "." on a line by itself.
+  # spams seem to only have NULL chars afterwards ?
+  if ($line_count) {
+    for(; $line_count > 0; $line_count--) {
+      if ($body->[-$line_count] =~ /[^\s.]/) {
+        $self->{mime_epilogue} = 1;
+        last;
+      }
+    }
+  }
+
 }
 
 =item _parse_normal()

Modified: spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/MIMEEval.pm
URL: http://svn.apache.org/viewvc/spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/MIMEEval.pm?view=diff&rev=553392&r1=553391&r2=553392
==============================================================================
--- spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/MIMEEval.pm (original)
+++ spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/MIMEEval.pm Wed Jul  4 23:44:24 2007
@@ -47,6 +47,7 @@
   $self->register_eval_rule("check_for_uppercase");
   $self->register_eval_rule("check_ma_non_text");
   $self->register_eval_rule("check_base64_length");
+  $self->register_eval_rule("check_mime_epilogue");
 
   return $self;
 }
@@ -505,6 +506,12 @@
   }
   
   return $result;
+}
+
+sub check_mime_epilogue {
+  my $self = shift;
+  my $pms  = shift;
+  return defined $pms->{msg}->{mime_epilogue};
 }
 
 1;