| Main Archive Page > Month Archives > spamassassin-users archives |
The Impossible Rule??? Bug???
From: corpus.defero <corpus.defero_at_nospam>Date: Tue Mar 23 2010 - 09:35:42 GMT
To: SpamAssassin <users@spamassassin.apache.org>
I was looking at a piece of irritating pill spam this morning
((http://pastebin.com/qzj83QKq)) and noticed this in the body, just
after a random excerpt from chapter 58 of 'The Awakening':
-----------34AD8EF316667417464496762D36F3502061F3
Content-Type: image/bmp; name="transistor.jpg"
Content-Transfer-Encoding: base64
Content-Disposition: inline
Having some time to play I was interested to see a slight mismatch there
in the content type. Claims to be a bmp, but has a .jpg extension.
Feeling it was worthy of a couple of points (it scored 0 when it first
arrived) I tried to create a custom rule for it.
Being in the body of the message I thought that 'rawbody' would be a
good starting point but neither:
rawbody RB_MFT01 /Content\-Type: image\/bmp(.{1,30})\.jpg/i
score RB_MFT01 3.0
OR
rawbody RB_MFT01 /Content\-Type: image\/bmp/i
score RB_MFT01 3.0
Would catch on it.
Examples found on the 'Content-Type' suggested it was a header, but even
stripping it back to:
header HD_MFT01 Content-Type =~ /image\/bmp;/
Would not catch on it.
Google seemed to offer no clues other than a few suggestions for
attachment filtering hacks and plugins, but they did not appear to offer
the match (bmp but .jpg) that I was looking to achieve.
Is this something that can't be done with Spamassassin? Is it an
'impossible rule'? Is it a bug? The documentation is not giving me any
obvious tips on this?