Testing with four spaces before "Testing" was Re: Rule for subjects that start with a whitespace

[jdow <jd...@earthlink.net>]

So this should tell something. I'm not sure what.
{^_-}
----- Original Message ----- 
From: <ha...@t-online.de>

> Hi Ralph,
>
> now if most software is sending a message with 0 or 1 whitespace after the
colon,
> it might be an idea to consider 2 or more whitespaces there as an
indicator of an unusual
> mail program.
> Now if it could be confirmed that certain often used mailers always trim
the subject
> specified by the user, and send with exactly one whitespace, then the
combination of
> mailer name and two whitespaces would be at least a sure indicator that
the mailer name
> was forged.
>
> Wolfgang Hamann
>
> >>
> >> Perhaps you misread the RFC excerpt a bit? only the field name (!)
> >> must be composed of characters between 33 and 126. The definition
> >>
> >>    subject = "Subject:" unstructured CRLF
> >>
> >> implies that, as far as I understand, the field body starts with the
> >> character immediately after the colon.
> >>
> >>  > Now, as to how SpamAssassin parses the Subject field is open for
> >>  > question. It appears a lot of rules seem to start presuming zero
> >>  > or more blank characters followed by the real search string.
> >>
> >> As I wrote before: I believe that many software products dealing
> >> with email assume that the field body starts with the first non-
> >> whitespace character after zero or more whitespaces, or that they
> >> make use of functions like trim() to remove any leading/trailing
> >> whitespaces as they see fit, i.e. when storing or displaying
> >> messages. I don't know if checking for "surplus" whitespaces in
> >> field bodies has a realistic chance of success.
> >>
> >> -- 
> >> Mit freundlichen Grüßen / Sincerely
> >> Dipl. Inform. Ralph Seichter
> >>
> >>
>
>
>

Re: Testing with four spaces before "Testing" was Re: Rule for subjects that start with a whitespace

[Kenneth Porter <sh...@sewingwitch.com>]

--On Saturday, August 06, 2005 4:18 PM -0700 jdow <jd...@earthlink.net> 
wrote:

> By that I meant that "telnet localhost pop3" followed by an "retr 1"
> (once logged in) showed the spaces normalized to exactly one in all cases.

That's interesting... I just went checking my uncaught spam folder for 
headers that have multiple spaces after the colon and found them only in 
attachments. So then I sent myself a message with leading spaces in the 
subject from one server to another and found them there when inspecting my 
Inbox from a text editor. I then looked with my mail client using IMAP and 
Dovecot, and when I closed the folder, Dovecot rewrote the mailbox in 
canonical form. Bug?

Re: Testing with four spaces before "Testing" was Re: Rule for subjects that start with a whitespace

[jdow <jd...@earthlink.net>]

From: "Kenneth Porter" <sh...@sewingwitch.com>

> --On Saturday, August 06, 2005 3:23 AM -0700 jdow <jd...@earthlink.net>
> wrote:
>
> > Tells me that dovecot normalizes headers to include exactly one space.
> > (I did a little more testing with zero spaces squeezed through procmail
> > to my mail folder. It came through that just fine. But it lost the
> > customized spacing in dovecot.)
>
> By that I assume you mean that the Subject returned by an IMAP header
> command is normalized. I would expect that Dovecot delivers the headers
> unchanged when you ask for the whole message. An IMAP client would
> typically use the result of the header command for message list display.
> What it uses for per-message display could be either, but I'd probably use
> the result of the header command since it's already parsed out of the body
> by the server and I don't have to do extra work to extract it.

By that I meant that "telnet localhost pop3" followed by an "retr 1"
(once logged in) showed the spaces normalized to exactly one in all cases.

{^_^}

Re: Testing with four spaces before "Testing" was Re: Rule for subjects that start with a whitespace

[Kenneth Porter <sh...@sewingwitch.com>]

--On Saturday, August 06, 2005 3:23 AM -0700 jdow <jd...@earthlink.net> 
wrote:

> Tells me that dovecot normalizes headers to include exactly one space.
> (I did a little more testing with zero spaces squeezed through procmail
> to my mail folder. It came through that just fine. But it lost the
> customized spacing in dovecot.)

By that I assume you mean that the Subject returned by an IMAP header 
command is normalized. I would expect that Dovecot delivers the headers 
unchanged when you ask for the whole message. An IMAP client would 
typically use the result of the header command for message list display. 
What it uses for per-message display could be either, but I'd probably use 
the result of the header command since it's already parsed out of the body 
by the server and I don't have to do extra work to extract it.

Re: Testing with four spaces before "Testing" was Re: Rule for subjects that start with a whitespace

[jdow <jd...@earthlink.net>]

Tells me that dovecot normalizes headers to include exactly one space.
(I did a little more testing with zero spaces squeezed through procmail
to my mail folder. It came through that just fine. But it lost the
customized spacing in dovecot.)

{^_^}
----- Original Message ----- 
From: "jdow" <jd...@earthlink.net>
To: <us...@spamassassin.apache.org>


> So this should tell something. I'm not sure what.
> {^_-}
> ----- Original Message ----- 
> From: <ha...@t-online.de>
>
> > Hi Ralph,
> >
> > now if most software is sending a message with 0 or 1 whitespace after
the
> colon,
> > it might be an idea to consider 2 or more whitespaces there as an
> indicator of an unusual
> > mail program.