You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by da...@apache.org on 2018/01/20 15:26:03 UTC
svn commit: r1821749 -
/spamassassin/branches/3.4/lib/Mail/SpamAssassin/Plugin/HeaderEval.pm
Author: davej
Date: Sat Jan 20 15:26:02 2018
New Revision: 1821749
URL: http://svn.apache.org/viewvc?rev=1821749&view=rev
Log:
Bug 6946
Modified:
spamassassin/branches/3.4/lib/Mail/SpamAssassin/Plugin/HeaderEval.pm
Modified: spamassassin/branches/3.4/lib/Mail/SpamAssassin/Plugin/HeaderEval.pm
URL: http://svn.apache.org/viewvc/spamassassin/branches/3.4/lib/Mail/SpamAssassin/Plugin/HeaderEval.pm?rev=1821749&r1=1821748&r2=1821749&view=diff
==============================================================================
--- spamassassin/branches/3.4/lib/Mail/SpamAssassin/Plugin/HeaderEval.pm (original)
+++ spamassassin/branches/3.4/lib/Mail/SpamAssassin/Plugin/HeaderEval.pm Sat Jan 20 15:26:02 2018
@@ -53,6 +53,7 @@ sub new {
$self->register_eval_rule("check_for_forged_eudoramail_received_headers");
$self->register_eval_rule("check_for_forged_yahoo_received_headers");
$self->register_eval_rule("check_for_forged_juno_received_headers");
+ $self->register_eval_rule("check_for_forged_gmail_received_headers");
$self->register_eval_rule("check_for_matching_env_and_hdr_from");
$self->register_eval_rule("sorted_recipients");
$self->register_eval_rule("similar_recipients");
@@ -574,6 +575,22 @@ sub check_for_forged_juno_received_heade
return 0;
}
+sub check_for_forged_gmail_received_headers {
+ my ($self, $pms) = @_;
+ use constant GOOGLE_MESSAGE_STATE_LENGTH => 102;
+
+ my $from = $pms->get('From:addr');
+ if ($from !~ /\bgmail\.com$/i) { return 0; }
+
+ my $xgms = $pms->get('X-Gm-Message-State');
+ my $xreceived = $pms->get('X-Received');
+
+ if (length($xgms) eq GOOGLE_MESSAGE_STATE_LENGTH) { return 0; }
+ if ($xreceived =~ /by 10\.\S+ with SMTP id \S+/) { return 0; }
+
+ return 1;
+}
+
sub check_for_matching_env_and_hdr_from {
my ($self, $pms) =@_;
# two blank headers match so don't bother checking