[Bug 7104] New: domain name contains a null label

[bu...@bugzilla.spamassassin.org]

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7104

            Bug ID: 7104
           Summary: domain name contains a null label
           Product: Spamassassin
           Version: 3.4.0
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Rules (Eval Tests)
          Assignee: dev@spamassassin.apache.org
          Reporter: axb.lists@gmail.com

Centos 6.6 x64
perl-Net-DNS-0.71-1.el6.rfx.x86_64
SA 3.4 Release

Borked URL like

<img src=3D"https://www=
..buchmann.ch/catalog/includes/languages/german/images/buttons/button_view.g=
if" border=3D"0" /></a>

spits out

Nov 25 14:20:41.809 [4224] dbg: check: tagrun - tag URIHOSTS is now ready,
value: ARY:[www..buchmann.ch,www.buchmann.ch,buchmann.ch]
Nov 25 14:20:41.810 [4224] dbg: uridnsbl: considering host=www..buchmann.ch,
domain=buchmann.ch
Nov 25 14:20:41.827 [4224] dbg: async: launching A/www..buchmann.ch for
A:www..buchmann.ch
Nov 25 14:20:41.827 [4224] warn: dns: new_dns_packet (domain=www..buchmann.ch.
type=A class=IN) failed: a domain name contains a null label


Should SA ty to trash such queries? or magically turn .. into .
I also see lots of these in weekly masschecks

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 7104] domain name contains a null label

[bu...@bugzilla.spamassassin.org]

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7104

--- Comment #4 from AXB <ax...@gmail.com> ---
AND turn borked queries into usefull ones

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 7104] domain name contains a null label

[bu...@bugzilla.spamassassin.org]

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7104

Kevin A. McGrail <km...@pccc.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |kmcgrail@pccc.com

--- Comment #1 from Kevin A. McGrail <km...@pccc.com> ---
I would likely recommend that multiple dots are turned into a single dot
because it could be a social engineering attempt to bypass RBLs.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 7104] domain name contains a null label

[bu...@bugzilla.spamassassin.org]

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7104

Joe Quinn <jq...@pccc.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jquinn+SAbug@pccc.com

--- Comment #2 from Joe Quinn <jq...@pccc.com> ---
For what it's worth, none of the major browsers will honor a request to visit
http://issues..apache.org/ so whatever this trick is trying to do, it's
probably not working.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 7104] domain name contains a null label

[bu...@bugzilla.spamassassin.org]

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=7104

--- Comment #3 from Kevin A. McGrail <km...@pccc.com> ---
(In reply to Joe Quinn from comment #2)
> For what it's worth, none of the major browsers will honor a request to
> visit http://issues..apache.org/ so whatever this trick is trying to do,
> it's probably not working.

I'm thinking hand typed where a person ignores the double dot as a misspelling.

Do mail clients highlight/autolink the URL?

-- 
You are receiving this mail because:
You are the assignee for the bug.