You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2009/08/24 17:09:00 UTC
svn commit: r807274 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Mon Aug 24 15:09:00 2009
New Revision: 807274
URL: http://svn.apache.org/viewvc?rev=807274&view=rev
Log:
Possible image spam rule
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=807274&r1=807273&r2=807274&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Mon Aug 24 15:09:00 2009
@@ -48,4 +48,10 @@
header UNQ_MIME_BDRY Content-Type =~ /boundary=[^"]/i
describe UNQ_MIME_BDRY Unquoted MIME boundary string
+# 08/2009 image spams using specific pattern indicating tbird forgery?
+ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
+ mimeheader __IMAGE_JPEG_ATTACH Content-Type =~ /image\/jpeg/i
+ header __TB_MIME_BDRY_0D0D Content-Type =~ /boundary=\S+-{8}(?:0[1-9]){10,}/i
+ meta FORGED_TBIRD_IMAGE (___MUA_TBIRD && __IMAGE_JPEG_ATTACH && __TB_MIME_BDRY_0D0D)
+endif