You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2009/03/09 16:00:45 UTC
[Bug 6082] New: FM_FRM_RN_L_BRACK fires on iso-2022
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6082
Summary: FM_FRM_RN_L_BRACK fires on iso-2022
Product: Spamassassin
Version: 3.2.5
Platform: Other
OS/Version: All
Status: NEW
Severity: normal
Priority: P5
Component: Rules
AssignedTo: dev@spamassassin.apache.org
ReportedBy: brennan@columbia.edu
Google FM_FRM_RN_L_BRACK to see various reports showing this false positive.
But I did not find a bug report, so here it is.
Take any test message and substitute this From line, below, and it will hit
FM_FRM_RN_L_BRACK even though the address is correctly bracketed:
From: =?iso-2022-jp?B?GyRCOWI2NhsoQiAbJEI+PxsoQg==?= <br...@columbia.edu>
However the following does not hit:
From: =?iso-2022-jp?B?blurfl==?= <br...@columbia.edu>
So the bug seems to relate to what's in the iso-2022 data, but sorry to say I
have no suggestions beyond that. I cannot read Japanese. The first example
has my own address rather than the real sender address but the iso-2022 part is
verbatim from a user report to us at Columbia Univ IT.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6082] FM_FRM_RN_L_BRACK fires on iso-2022
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6082
--- Comment #1 from Theo Van Dinter <fe...@apache.org> 2009-03-09 09:46:30 PST ---
The rule is for the name part of the From header, not the address. It looks
for names that have ">" but not "<". Sure enough,
GyRCOWI2NhsoQiAbJEI+PxsoQg== decodes to "9b66 >?"
blurfl== decodes to a string with no '>' in it.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6082] FM_FRM_RN_L_BRACK fires on iso-2022
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6082
--- Comment #3 from Henrik Krohns <he...@hege.li> 2009-03-09 22:31:18 PST ---
See https://issues.apache.org/SpamAssassin/show_bug.cgi?id=5201 for similar
bug.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6082] FM_FRM_RN_L_BRACK fires on iso-2022
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6082
--- Comment #2 from Joseph Brennan <br...@columbia.edu> 2009-03-09 10:48:16 PST ---
It uses From:name because if the "<" is missing, the address will be parsed as
part of the name. Isn't it looking for this type of mangled faked sender?--
From: Great Deals blabla@example.com>
If so, probably what we want to do is find a string not starting "<" but ending
">", something like /\b[^<][^\s]+>\b/, except that I'm not sure how to
reference the complete unencoded From.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6082] FM_FRM_RN_L_BRACK fires on iso-2022
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6082
Kevin A. McGrail <km...@pccc.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
CC| |kmcgrail@pccc.com
Resolution|--- |FIXED
--- Comment #4 from Kevin A. McGrail <km...@pccc.com> ---
Rule is disabled due to FPs
--
You are receiving this mail because:
You are the assignee for the bug.