You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "corpus.defero" <co...@idnet.com> on 2010/03/23 10:35:42 UTC
The Impossible Rule??? Bug???
I was looking at a piece of irritating pill spam this morning
((http://pastebin.com/qzj83QKq)) and noticed this in the body, just
after a random excerpt from chapter 58 of 'The Awakening':
-----------34AD8EF316667417464496762D36F3502061F3
Content-Type: image/bmp; name="transistor.jpg"
Content-Transfer-Encoding: base64
Content-Disposition: inline
Having some time to play I was interested to see a slight mismatch there
in the content type. Claims to be a bmp, but has a .jpg extension.
Feeling it was worthy of a couple of points (it scored 0 when it first
arrived) I tried to create a custom rule for it.
Being in the body of the message I thought that 'rawbody' would be a
good starting point but neither:
rawbody RB_MFT01 /Content\-Type: image\/bmp(.{1,30})\.jpg/i
score RB_MFT01 3.0
OR
rawbody RB_MFT01 /Content\-Type: image\/bmp/i
score RB_MFT01 3.0
Would catch on it.
Examples found on the 'Content-Type' suggested it was a header, but even
stripping it back to:
header HD_MFT01 Content-Type =~ /image\/bmp;/
Would not catch on it.
Google seemed to offer no clues other than a few suggestions for
attachment filtering hacks and plugins, but they did not appear to offer
the match (bmp but .jpg) that I was looking to achieve.
Is this something that can't be done with Spamassassin? Is it an
'impossible rule'? Is it a bug? The documentation is not giving me any
obvious tips on this?
Re: The Impossible Rule??? Bug???
Posted by "corpus.defero" <co...@idnet.com>.
On Tue, 2010-03-23 at 10:00 +0000, --[ UxBoD ]-- wrote:
> mimeheader __ANY_IMAGE_ATTACH Content-Type =~ /image\/(?:gif|jpe?g|png|bmp)/
> mimeheader MIME_IMAGE_JPG Content-Type =~ /image\/jpg/
> describe MIME_IMAGE_JPG Contains wrong MIME type image\/jpg
> score MIME_IMAGE_JPG 1.0
That's just what the doctor ordered! Thank you :-)
>
Re: The Impossible Rule??? Bug???
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Tue, 23 Mar 2010, --[ UxBoD ]-- wrote:
> ----- "corpus.defero" <co...@idnet.com> wrote:
>
> > I was looking at a piece of irritating pill spam this morning
> > ((http://pastebin.com/qzj83QKq)) and noticed this in the body, just
> > after a random excerpt from chapter 58 of 'The Awakening':
> >
> > -----------34AD8EF316667417464496762D36F3502061F3
> > Content-Type: image/bmp; name="transistor.jpg"
> > Content-Transfer-Encoding: base64
> > Content-Disposition: inline
> >
> > Having some time to play I was interested to see a slight mismatch
> > there
> > in the content type. Claims to be a bmp, but has a .jpg extension.
> > Feeling it was worthy of a couple of points (it scored 0 when it
> > first
> > arrived) I tried to create a custom rule for it.
[snip..]
> I use this one :-
>
> mimeheader __ANY_IMAGE_ATTACH Content-Type =~ /image\/(?:gif|jpe?g|png|bmp)/
> mimeheader MIME_IMAGE_JPG Content-Type =~ /image\/jpg/
> describe MIME_IMAGE_JPG Contains wrong MIME type image\/jpg
> score MIME_IMAGE_JPG 1.0
Um, that rule will fire on any jpg image attachment, not quite what the
OP was looking for. I think that he wanted a rule that will look for an
implicit mis-match between the declared mime type and the file extension.
You can do that with the mimeheader type but need to be careful. Cannot do
it with METAs w/o risk of FPs, as there could be a message with both a
"bmp" and "jpg" attachment.
So need to do it with one long pattern-match.
Untested but try:
mimeheader MIME_MISMATCH_JPG Content-Type =~ m!image/bmp;\s+name="?[^.]{1,40}\.jpg"?$!i
describe MIME_MISMATCH_JPG Contains wrong MIME type image\/bmp
score MIME_MISMATCH_JPG 1.0
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: The Impossible Rule??? Bug???
Posted by "--[ UxBoD ]--" <ux...@splatnix.net>.
----- "corpus.defero" <co...@idnet.com> wrote:
> I was looking at a piece of irritating pill spam this morning
> ((http://pastebin.com/qzj83QKq)) and noticed this in the body, just
> after a random excerpt from chapter 58 of 'The Awakening':
>
> -----------34AD8EF316667417464496762D36F3502061F3
> Content-Type: image/bmp; name="transistor.jpg"
> Content-Transfer-Encoding: base64
> Content-Disposition: inline
>
> Having some time to play I was interested to see a slight mismatch
> there
> in the content type. Claims to be a bmp, but has a .jpg extension.
> Feeling it was worthy of a couple of points (it scored 0 when it
> first
> arrived) I tried to create a custom rule for it.
>
> Being in the body of the message I thought that 'rawbody' would be a
> good starting point but neither:
>
> rawbody RB_MFT01 /Content\-Type: image\/bmp(.{1,30})\.jpg/i
> score RB_MFT01 3.0
>
> OR
>
> rawbody RB_MFT01 /Content\-Type: image\/bmp/i
> score RB_MFT01 3.0
>
> Would catch on it.
>
> Examples found on the 'Content-Type' suggested it was a header, but
> even
> stripping it back to:
>
> header HD_MFT01 Content-Type =~ /image\/bmp;/
>
> Would not catch on it.
>
> Google seemed to offer no clues other than a few suggestions for
> attachment filtering hacks and plugins, but they did not appear to
> offer
> the match (bmp but .jpg) that I was looking to achieve.
>
> Is this something that can't be done with Spamassassin? Is it an
> 'impossible rule'? Is it a bug? The documentation is not giving me
> any
> obvious tips on this?
I use this one :-
mimeheader __ANY_IMAGE_ATTACH Content-Type =~ /image\/(?:gif|jpe?g|png|bmp)/
mimeheader MIME_IMAGE_JPG Content-Type =~ /image\/jpg/
describe MIME_IMAGE_JPG Contains wrong MIME type image\/jpg
score MIME_IMAGE_JPG 1.0
--
Thanks, Phil