procmail
[Top] [All Lists]

Re: No good spamming bastards are using new tricks to get by the filters

2003-01-19 20:03:22
On 01/19/03 05:31 PM, LuKreme sat at the `puter and typed:
On Sunday, January 19, 2003, at 11:12 AM, Louis LeBlanc wrote:
<Snipped to prevent this message getting eaten by the very filters being 
discussed>

Blah.  That last recipe doesn't quite work.  When my last message came
back from the list, that recipe hung in the sed command and it never
got delivered.  Well, it certainly kills messages with HTML comments
anyway :)

Here's the recipe again, just in case:

:0B:
* (<)!--
| sed -e 's/<!--/\r<!--/g'
:0A
{
  :0B:
  * -2^0
  * B ? 1^0 (<)!--
  | formail -Y -f -A "X-Spammer: HTML Comments out the wazoo"
  :0A
  { FOLDER=spam }
}

Only it's now commented out in my procmailrc of course.

I'm wondering if there's another way I could just count every instance
of <!-- regardless of how many are on a line?  If so, I could
eliminate all but that inside the outer {} - with corrections, of
course:

:0B:
* -2^0
* B ? 1^0 (<)!--
| formail -Y -f -A "X-Spammer: HTML Comments out the wazoo"
:0A
{ FOLDER=spam }

Any help there?

Another idea is to check the Content-Type to see if it's really an
html message.  That one's easy enough, but would it be worthwhile?

Thanks again folks

Lou
-- 
Louis LeBlanc               leblanc(_at_)keyslapper(_dot_)org
Fully Funded Hobbyist, KeySlapper Extrordinaire :)
http://www.keyslapper.org                     ԿԬ

Fortunately, the second-to-last bug has just been fixed.
    -- Ray Simard

_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail