procmail
[Top] [All Lists]

Re: Outlook Exploit Filter?

2000-07-20 03:17:22
From: Lee Howard <faxguy(_at_)deanox(_dot_)com>

John, I thought that your filters checked for excessive header stuff. (?)
Anyway, something like this should do the trick, shouldn't it?

# ==============

DATEHEADERCOUNT=`grep -e "^Date:" -i | wc -c`
DATEHEADERFLAG=`expr 50 - $DATEHEADERCOUNT | sed s/[0-9].*//`

:0
* DATEHEADERFLAG ?? ^^-^^
/dev/null

# ==============

Obviously, we'd want this to do some other action other than /dev/null ,
but isn't this the general idea?  Is 50 characters in a Date: header
sufficient?

I don't really know what you guys are up to with this heuristic.
However, I don't see why you are calling all sorts of external pipes
and shell commands.  This seems to me to be using quite a bit of
processing overhead inefficiently to do something that procmail was
"born" to do naturally with its internal egrep.  (Unless I am
misunderstanding something.)

Since you're talking, heuristically speaking, about "less than 50 (of
something)," I would tend to think that a scoring recipe would be the
best algorithmic utensil.  However, after all these years of
procmailing, I only just six or eight weeks ago finally brought myself
to be able to read entirely through man procmailrc and believe that I
understood even about 3/4 of what I was reading.  And I have yet
really to try building a scored recipe.  :-)  This can also be done
easily enough without scoring, though, I think.  :-)

        :0 i  # 50 dots; line-continuation for easy mutability/readability
        * ^Date: \/.........................\
                   .........................
        {
           fiftyOrMORE = $MATCH

           :0
           | [ do something with $fiftyOrMORE ]
        }


Or something.  :-)

-- 
    \     .-.     .-.     .-.     .-.     .-.     .-.     .-.     /
     \-d-/-m-\-a-/-n-\-(_at_)-/-n-\-e-/-t-\-c-/-o-\-m-/-.-\-c-/-o-\-m-/
      '-'     '-'     '-'     '-'     '-'     '-'     '-'     '-'

_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>