You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2014/09/05 21:32:11 UTC
svn commit: r1622769 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Fri Sep 5 19:32:10 2014
New Revision: 1622769
URL: http://svn.apache.org/r1622769
Log:
add another test rule
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1622769&r1=1622768&r2=1622769&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Fri Sep 5 19:32:10 2014
@@ -1705,4 +1705,13 @@ body __TVD_GET_STOCK_2 /
# reported on users list 09/2014 jdebert <jd...@garlic.com>
header __RCVD_DBL_DQ Received =~ /(?:\[\d+\.\d+\.\d+\.\d+\]){2}/
+# reported on users list 09/2014 George Johnson <ge...@talaya.net>
+header __RAND_HEADER ALL =~ /^(?!Accept-Language|Authentication-Results|Content-|DomainKey-Signature|Received-SPF|Return-Path|Thread-)[a-z]{5,}-[a-z]{3,}:\s+(?:\d{3,}[-\.][0-9a-f]{6,}|\d{6,}(?:[-\.]\d{2,5})?|[0-9a-f]{30,})$/ism
+tflags __RAND_HEADER multiple, maxhits=5
+meta RAND_HEADER_MANY __RAND_HEADER > 4
+describe RAND_HEADER_MANY Many random gibberish message headers
+score RAND_HEADER_MANY 2.000 # limit
+
+
+