procmail
[Top] [All Lists]

Re: Detecting "Content-Type: multipart/related;" for virus protection

2001-11-30 22:55:57

In checking the symptoms of the malformed headers previously mentioned in this thread, I noticed:

somehosedmessage:

From Schmuck date
MIME-Version: 1.0
Content-Type: multipart/unrelated;
type="unipart/alternative";
boundary="====_QWE1234567890RTY_===="
Subject: OutBreak sucks!
From: doofus infected user

(MIME headers screwed with so as not to unnecessarily freak out any ill-devised scripts currently being used by listmembers - the content isn't as important as the lack of indentation and the fact that important headers follow the malformed MIME)

(formail v3.14 2000/08/25)

        formail -I "X-Someheader: value" < cat somehosedmessage

results in the header ending at the non-indented type= line. NOT at a blank line. Headers which follow the malformed mime header components will also appear in the body.

        formail -xFrom: < cat somehosedmessage

results in NULL - formail doesn't find the specified header because it believes the header has ended before it really has.


Obviously, perhaps formail needs to be tweaked to make it more forgiving of the malformed OutBreak mime headers (perhaps adding a new option to optionally apply a fix while it's there?).

        sed -e 's/^\(type\|boundary\)\(="\)/ \1\2/' < somehosedmessage |
                formail -xFrom:

will produce the desired result. Certainly, one wouldn't do this on each invocation, but if the malformed headers are a concern, using a filter such as I provided in my previous message would fix those messages which are broken in this fashion, and allow all following rules successfully without modification.
---
 Sean B. Straw / Professional Software Engineering

 Procmail disclaimer: <http://www.professional.org/procmail/disclaimer.html>
 Please DO NOT carbon me on list replies.  I'll get my copy from the list.

_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>