procmail
[Top] [All Lists]

Re: procmail antivirus recipe trashing messages sent via photo suite

2001-08-03 17:45:26
At 17:25 2001-08-03 -0500, Chris Cook wrote:
that my recipe is also trashing any messages sent via the imaging
application Photo Suite.  I have attached a log of what rules it matched
on and also our recipe.  Could someone tell me where in the recipe that
the rule is matching?

Not really without the MESSAGE it matched against (not that we want that on the list) -- the specific text it tripped up on could be virtually any line in the body of the message.

procmail: No match on ".*UNREGASF\.EXE"
procmail: No match on ".*Navidad\.exe"

[snip - lots of these]

procmail: Match on ".*\.(vbs|wsf|shs|scr|pif|bat|com)"

you matched on this.  See below for why.

:0 hBHw
* ^Content-type: (multipart/mixed|application/octet-stream)
{
         :0B
         * .*creative\.exe
         /dev/null
[snip - a bunch just like it]

Considering that the logfile clearly indicated that the other filename matches you were looking for were not found, they don't inherently need to be included. It's the following line that is getting you:

         :0B
         * .*\.(vbs|wsf|shs|scr|pif|bat|com|lnk)
         /dev/null

*ANYWHERE* in the body - which includes the MIME encoding itself, you can match any of these sequences of characters preceeded by a dot.

Yea, no surprise there that it might upchuck on random files. Try at least prefixing this condition line with:

        * ^[    ]*filename=".*\.(vbs|wsf|shs|scr|pif|bat|com|lnk)"

(this recommendation applies equally to the explicit filename checks as well).

You might also consider moving this rule to the top of the batch, since it can, in one fell swoop, match a fair number of possibles.


---
 Sean B. Straw / Professional Software Engineering

 Procmail disclaimer: <http://www.professional.org/procmail/disclaimer.html>
 Please DO NOT carbon me on list replies.  I'll get my copy from the list.

_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail