You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@spamassassin.apache.org on 2021/03/30 19:02:53 UTC
[Bug 7896] New: Seeming counting error with tflags multiple
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7896
Bug ID: 7896
Summary: Seeming counting error with tflags multiple
Product: Spamassassin
Version: 3.4.0
Hardware: PC
OS: Windows XP
Status: NEW
Severity: normal
Priority: P2
Component: Rules
Assignee: dev@spamassassin.apache.org
Reporter: lwilton@earthlink.net
Target Milestone: Undefined
I have the following rule in user_prefs:
header __DUP_LIST_UNSUBSCRIBE List-Unsubscribe =~ /./
tflags __DUP_LIST_UNSUBSCRIBE multiple
meta LW_DUP_LIST_UNSUBSCRIBE (__DUP_LIST_UNSUBSCRIBE > 1)
score LW_DUP_LIST_UNSUBSCRIBE 1
describe LW_DUP_LIST_UNSUBSCRIBE Two or more List-Unsubscribe
headers
I received a spam that hit (among many others) this rule:
1.0 LW_DUP_LIST_UNSUBSCRIBE Two or more List-Unsubscribe headers
The problem is there is only one List-Unsubscribe header in the message. I
think that the header detection may have been fooled by the formatting of the
DKIM-Signature header:
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; s=dkim;
d=product-bills.com;
h=Message-ID:Date:Subject:From:Reply-To:To:MIME-Version:Content-Type:
List-Unsubscribe:List-Id;
bh=j+nGf5OHKxHxXjPQ+72DSHdl8grj1qHvjk8tfDj3sa4=;
b=gE60zOF5GYxkCSCqMmkSfBz4m0Vt6dwCxW9C4hqQdVK3dEOvc3UeRW/YREKlUXmqVSe9f1aHviYI
0rpcUTG0D7HYJmyjJFSxqladmipwlBqGg9XceK/2MXmA7iCoNCXm78Ag/gPnzwzzbjBhUwRoQ+C/
K+vmtIzKXdYTlw8azYM=
List-Unsubscribe:
<http://ehk74.com/index.php/lists/tx608bw2ye27b/unsubscribe/mq0498zn4qe56/wq618tykbad15/unsubscribe-direct?source=email-client-unsubscribe-button>,
<mailto:noreply@awscell.com?subject=Campaign-Uid:wq618tykbad15 /
Subscriber-Uid:mq0498zn4qe56 - Unsubscribe request&body=Please unsubscribe
me!>
Note the " List-Unsubscribe:" in the DKIM-Signature multiline text.
I can supply the original spam if the above is not enough to track the problem
down.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7896] Seeming counting error with tflags multiple
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7896
Bill Cole <bi...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |billcole@apache.org
--- Comment #1 from Bill Cole <bi...@apache.org> ---
Without anchoring, I believe that rule will match as many times as there are
characters in the List-Unsubscribe header.
To debug, use the '-D rules' option for spamassassin and look in the output for
the matches to your rule. Or just put a '^' in front of the '.' in the regex.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7896] Seeming counting error with tflags multiple
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7896
Loren Wilton <lw...@earthlink.net> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |lwilton@earthlink.net
--- Comment #3 from Loren Wilton <lw...@earthlink.net> ---
Thanks Bill!
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7896] Seeming counting error with tflags multiple
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7896
RW <rw...@googlemail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |rwmaillists@googlemail.com
--- Comment #4 from RW <rw...@googlemail.com> ---
(In reply to Bill Cole from comment #2)
> Changing the regex to '/^./' solves the problem.
The regex needs to be '/^./m'
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7896] Seeming counting error with tflags multiple
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7896
Bill Cole <bi...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |WORKSFORME
Status|NEW |RESOLVED
--- Comment #2 from Bill Cole <bi...@apache.org> ---
(In reply to Bill Cole from comment #1)
> Without anchoring, I believe that rule will match as many times as there are
> characters in the List-Unsubscribe header.
>
> To debug, use the '-D rules' option for spamassassin and look in the output
> for the matches to your rule. Or just put a '^' in front of the '.' in the
> regex.
I have confirmed that with the rules provided and mail with this header:
List-Unsubscribe: 123
A check by 'spamassassin -D rules' shows these matches:
Mar 30 16:56:17.093 [8735] dbg: rules: ran header rule
__DUP_LIST_UNSUBSCRIBE ======> got hit: "1"
Mar 30 16:56:17.094 [8735] dbg: rules: ran header rule
__DUP_LIST_UNSUBSCRIBE ======> got hit: "2"
Mar 30 16:56:17.094 [8735] dbg: rules: ran header rule
__DUP_LIST_UNSUBSCRIBE ======> got hit: "3"
Changing the regex to '/^./' solves the problem.
Works as designed.
--
You are receiving this mail because:
You are the assignee for the bug.