You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@spamassassin.apache.org on 2020/10/23 11:54:20 UTC
[Bug 7863] New: Rules suggest
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7863
Bug ID: 7863
Summary: Rules suggest
Product: Spamassassin
Version: unspecified
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Rules
Assignee: dev@spamassassin.apache.org
Reporter: ricardo.matos@cgtp.pt
Target Milestone: Undefined
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7863] Suggest rule to score messages with attachments
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7863
Henrik Krohns <ap...@hege.li> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |apache@hege.li
--- Comment #4 from Henrik Krohns <ap...@hege.li> ---
There's really no point to these kinds of rules in stock ruleset, every site
has different attachment policies. Others might want to allow something that
others might not. It would be impossible to masscheck reliably, so everything
would be scored 0.001. Or you would have simply hundred different
__ATTACHMENT_XYZ rules just taking space and memory, hoping that someone would
use them instead of just making local rules like most probably do.
Also it's completely another thing to detect actual content vs relying on
provided filename extension. Stuff like this should be a generic file type
detection plugin.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7863] Suggest rule to score messages with attachments
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7863
Henrik Krohns <ap...@hege.li> changed:
What |Removed |Added
----------------------------------------------------------------------------
Hardware|PC |All
Status|NEW |RESOLVED
OS|Linux |All
Resolution|--- |WONTFIX
--- Comment #5 from Henrik Krohns <ap...@hege.li> ---
Closing from lack of comments and I don't believe here's anything to consider
for stock ruleset.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7863] Suggest rule to score messages with attachments
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7863
John Hardin <jh...@impsec.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |jhardin@impsec.org
--- Comment #3 from John Hardin <jh...@impsec.org> ---
There are already quite a few "message has attachment of type X" rules.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7863] Suggest rule to score messages with attachments
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7863
Kevin A. McGrail <km...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |kmcgrail@apache.org
--- Comment #2 from Kevin A. McGrail <km...@apache.org> ---
Hi Ricardo, with the exception of scoring JAR files, this looks like an
interesting framework to build on for attachment detection using the MIMEHeader
plugin.
Could you discuss in on the users list more? Are you using this in your rules?
Have you improved it more?
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7863] Suggest rule to score messages with attachments
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7863
ricardo.matos@cgtp.pt changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|Rules suggest |Suggest rule to score
| |messages with attachments
CC| |ricardo.matos@cgtp.pt
--- Comment #1 from ricardo.matos@cgtp.pt ---
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __MIMEHEADER_CONTENTTYPE_ATTACHMENT_DOC Content-Type =~
/\.(doc|xls|ppt)(x|)/i
mimeheader __MIMEHEADER_CONTENTDISP_ATTACHMENT_DOC Content-Disposition =~
/\.(doc|xls|ppt)(x|)/i
meta MIMEHEADER_ATTACHMENT_DOC ((__MIMEHEADER_CONTENTDISP_ATTACHMENT_DOC ||
__MIMEHEADER_CONTENTTYPE_ATTACHMENT_DOC) && !(ALL_TRUSTED))
describe MIMEHEADER_ATTACHMENT_DOC HEADER: email contains a DOC file attachment
score MIMEHEADER_ATTACHMENT_DOC 1.5
mimeheader __MIMEHEADER_CONTENTTYPE_ATTACHMENT_ARCH Content-Type =~
/\.(rar|zip|tar|img)/i
mimeheader __MIMEHEADER_CONTENTDISP_ATTACHMENT_ARCH Content-Disposition =~
/\.(rar|zip|tar|img)/i
mimeheader __MIMEHEADER_CONTENTDISP_ANY Content-Disposition =~ /./i
meta MIMEHEADER_ATTACHMENT_ARCH ((__MIMEHEADER_CONTENTDISP_ATTACHMENT_ARCH ||
__MIMEHEADER_CONTENTTYPE_ATTACHMENT_ARCH) && !ALL_TRUSTED)
describe MIMEHEADER_ATTACHMENT_ARCH HEADER: email contains an archive file
attachment
score MIMEHEADER_ATTACHMENT_ARCH 0.1
mimeheader __MIMEHEADER_CONTENTTYPE_ATTACHMENT_HTML Content-Type =~
/\.htm(l|)/i
mimeheader __MIMEHEADER_CONTENTDISP_ATTACHMENT_HTML Content-Disposition =~
/\.htm(l|)/i
meta MIMEHEADER_ATTACHMENT_HTML (__MIMEHEADER_CONTENTDISP_ATTACHMENT_HTML ||
__MIMEHEADER_CONTENTTYPE_ATTACHMENT_HTML)
describe MIMEHEADER_ATTACHMENT_HTML HEADER: email contains a HTML file
attachment
score MIMEHEADER_ATTACHMENT_HTML 1.0
mimeheader __MIMEHEADER_CONTENTTYPE_ATTACHMENT_JAR Content-Type =~
/application.*\.(jar|js|bat|exe|com|sh|vb|vbs|pif)"/i
mimeheader __MIMEHEADER_CONTENTDISP_ATTACHMENT_JAR Content-Disposition =~
/\.(jar|js|bat|exe|com|sh|vb|vbs|pif)"/i
meta MIMEHEADER_ATTACHMENT_JAR (__MIMEHEADER_CONTENTDISP_ATTACHMENT_JAR ||
__MIMEHEADER_CONTENTTYPE_ATTACHMENT_JAR)
describe MIMEHEADER_ATTACHMENT_JAR HEADER: email contains a JAR (or other
executable) file attachment
score MIMEHEADER_ATTACHMENT_JAR 2.0
endif
--
You are receiving this mail because:
You are the assignee for the bug.