You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Edward Prendergast <ed...@netring.co.uk> on 2011/09/08 17:14:18 UTC
CTYPE_NULL false-positive for Content-Type: multipart/related ?
Hi,
I'm seeing CTYPE_NULL triggering for certain messages from gmail.
If I compare a message that doesn't trigger CTYPE_NULL:
Content-Type: multipart/related;
With one that does:
Content-Type: multipart/related;
I'm thinking it looks like a false positive rather than a legitimate hit?
This is on SpamAssassin 3.3.1.
Thanks,
Edward
************
The information in this email is confidential and may be legally privileged.
It is intended solely for the addressee. Access to this email by anyone else
is unauthorised. If you are not the intended recipient, any action taken or
omitted to be taken in reliance on it, any form of reproduction,
dissemination, copying, disclosure, modification, distribution and/or
publication of this E-mail message is strictly prohibited and may be
unlawful. If you have received this E-mail message in error, please notify
us immediately. Please also destroy and delete the message from your
computer.
************
Re: CTYPE_NULL false-positive for Content-Type: multipart/related
?
Posted by Edward Prendergast <ed...@netring.co.uk>.
On 08/09/11 16:23, John Hardin wrote:
> On Thu, 8 Sep 2011, Edward Prendergast wrote:
>
>> I'm seeing CTYPE_NULL triggering for certain messages from gmail.
>>
>> If I compare a message that doesn't trigger CTYPE_NULL:
>>
>> Content-Type: multipart/related;
>>
>> With one that does:
>>
>> Content-Type: multipart/related;
>
> CTYPE_NULL certainly shouldn't fire on either of those. Are they
> really identical, or is that a cut-and-paste error? Are those complete
> copies of ALL of the Content-Type headers in the message?
>
> Would it be possible to post the full FP message to a pastebin? Given
> what we're looking at, anonymization of email addresses, host names
> and body content shouldn't affect the analysis, just make sure you
> don't alter any of the MIME-related headers.
>
Sorry, that WAS a typo, I meant to show a more standard content-type
from a message not triggering CTYPE_NULL:
Content-Type: multipart/mixed;
It's quite heavily redacted, but haven't made any changes to the MIME
header stuff.
https://gist.github.com/1203746
Thanks
************
The information in this email is confidential and may be legally privileged.
It is intended solely for the addressee. Access to this email by anyone else
is unauthorised. If you are not the intended recipient, any action taken or
omitted to be taken in reliance on it, any form of reproduction,
dissemination, copying, disclosure, modification, distribution and/or
publication of this E-mail message is strictly prohibited and may be
unlawful. If you have received this E-mail message in error, please notify
us immediately. Please also destroy and delete the message from your
computer.
************
Re: CTYPE_NULL false-positive for Content-Type: multipart/related
?
Posted by John Hardin <jh...@impsec.org>.
On Thu, 8 Sep 2011, Edward Prendergast wrote:
> I'm seeing CTYPE_NULL triggering for certain messages from gmail.
>
> If I compare a message that doesn't trigger CTYPE_NULL:
>
> Content-Type: multipart/related;
>
> With one that does:
>
> Content-Type: multipart/related;
CTYPE_NULL certainly shouldn't fire on either of those. Are they really
identical, or is that a cut-and-paste error? Are those complete copies of
ALL of the Content-Type headers in the message?
Would it be possible to post the full FP message to a pastebin? Given what
we're looking at, anonymization of email addresses, host names and body
content shouldn't affect the analysis, just make sure you don't alter any
of the MIME-related headers.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
When I say "I don't want the government to do X", do not
automatically assume that means I don't want X to happen.
-----------------------------------------------------------------------
9 days until the 224th anniversary of the signing of the U.S. Constitution