You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jm...@apache.org on 2006/10/24 17:49:55 UTC
svn commit: r467364 - /spamassassin/rules/branches/3.1/80_additional.cf
Author: jm
Date: Tue Oct 24 08:49:54 2006
New Revision: 467364
URL: http://svn.apache.org/viewvc?view=rev&rev=467364
Log:
backport some rules from rulesrc/sandbox/jm
Modified:
spamassassin/rules/branches/3.1/80_additional.cf
Modified: spamassassin/rules/branches/3.1/80_additional.cf
URL: http://svn.apache.org/viewvc/spamassassin/rules/branches/3.1/80_additional.cf?view=diff&rev=467364&r1=467363&r2=467364
==============================================================================
--- spamassassin/rules/branches/3.1/80_additional.cf (original)
+++ spamassassin/rules/branches/3.1/80_additional.cf Tue Oct 24 08:49:54 2006
@@ -265,6 +265,30 @@
mimeheader __TVD_OUTLOOK_IMG Content-Id =~ /<image\d+\.(?:gif|jpe?g|png)\@/
endif
+###########################################################################
+
+# backports from rulesrc/sandbox/jm/20_basic.cf
+ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
+
+mimeheader __PART_STOCK_CID Content-ID =~ /^<[a-f0-9]{12}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[^\s\.]+>$/
+mimeheader __PART_STOCK_IMG Content-Type =~ /image\/(?:gif|jpeg|png)/
+mimeheader __PART_STOCK_CL Content-Location =~ /./
+mimeheader __PART_STOCK_CD_F Content-Disposition =~ /filename/
+
+meta PART_CID_STOCK (__PART_STOCK_IMG&&__PART_STOCK_CID&&!__PART_STOCK_CL&&!__PART_STOCK_CD_F)
+describe PART_CID_STOCK Has a spammy image attachment (by Content-ID)
+
+mimeheader __PART_CID_STOCK_LESS Content-ID =~ /^<00[a-f0-9]{10}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[A-Za-z]+>$/
+meta PART_CID_STOCK_LESS (__PART_STOCK_IMG&&__PART_CID_STOCK_LESS)
+describe PART_CID_STOCK_LESS Has a spammy image attachment (by Content-ID, more specific)
+
+mimeheader CTYPE_1SPACE_GIF Content-Type:raw =~ /image\/gif;\n name=\".+?\"\s*$/s
+describe CTYPE_1SPACE_GIF Stock spam image part 'Content-Type' found
+
+endif # Mail::SpamAssassin::Plugin::MIMEHeader
+
+header RCVD_FORGED_WROTE Received =~ /from \d\S+\d \(HELO [a-z]\S+\) by \S+ with esmtp \([A-Z0-9]/s
+describe RCVD_FORGED_WROTE Forged 'Received' header found ('wrote:' spam)
###########################################################################
# SCORES