procmail
[Top] [All Lists]

Re: faked aol address

1998-03-24 20:06:37


On Tue, 24 Mar 1998, brett neely wrote:

In response to that "corrected" faked aol address filter (David Hunt?)
what if the email address comes in as:

From: Your Best Friend! <blahblah(_at_)aol(_dot_)com>

would a ".?" before the word boundary do it?

What I suggested was to add a token word boundary ( \> ) following ".com"
in the address and the expected angle bracket to the msgid.
        * ^From(_dot_)*(_at_)aol\(_dot_)com\>
        * ! ^Message-id:.*aol\.com>

I hate quoting manpages verbotem, but this says it all. (man procmailrc)
     \< or \>  Match the character before or after a word.   They
               are  merely  a  shorthand for `[^a-zA-Z0-9_]', but
               can also match newlines.  Since they match  actual
               characters,  they  are  only  suitable  to delimit
               words, not to delimit inter-word space.

So then, \> will match > or a comma or a newline or a space, which are
about the only characters one would expect at the end of an address.

By the way, I got to thinking about inverting the search as well, and also
making it work for several common suspects, and came up with this:

# common domainname forgeries:
SUSPECTS='
aol.com
juno.com
netcom.com
usa.net
yahoo.com
'
suspects=`echo $SUSPECTS|sed -e 's/[     ]/|/g' -e 's/[.]/[.]/g'`
        :0:
        * ^From [^       ]+@([^  ]+\.)?\/("$suspects")
        * $ ! ^Message-ID:.*\<"$MATCH">
                $HOME/mail/junkfile
        :0:
        * ^Message-ID:.*\<\/("$suspects")>
        * $ ! From [^    ]+@([^  ]+\.)?"$MATCH
                $HOME/mail/junkfile
# eof

Of course, if you don't like shell commands in recipes for efficiency
reasons, then 'suspects' can be simply:

suspects=aol.com|juno.com|netcom.com|usa.net|yahoo.com

David Hunt

<Prev in Thread] Current Thread [Next in Thread>