procmail
[Top] [All Lists]

Re: IL0VEY0U has mutated

2000-05-17 00:48:10
"John D. Hardin" <jhardin(_at_)wolfenet(_dot_)com> writes:
On Fri, 5 May 2000, Lars Hecking wrote:

 I am not sure whether this will work if the Content* header
 is spread over several lines.

That's one reason I recommend my sanitizer. Procmail does *not* unwrap
MIME headers in the body, so it's trivially easy to defeat roules like
this in a regular procmail script. F'rinstance:

 Content-Type: 
   application/octet-stream;
   name = 
   "YetAnotherVariant.TXT.vbs"

Hmm, my previous post allowed for the Content-* header to cover multiple
lines but it didn't allow whitespace after the '='.  Here's a corrected
condition:

        * B ?? ^Content-[-a-z0-9_]+:.*($[       ].*)*=[  ]*($[  ]+)*"?\
                [^"]*\.(vb[se]|ws[fh]|hta)


Philip Guenther

<Prev in Thread] Current Thread [Next in Thread>