procmail
[Top] [All Lists]

Re: No good spamming bastards are using new tricks to get by the filters

2003-01-20 10:22:30
On Mon, 20 Jan 2003 the voices made LuKreme write:

L> This is what I would start with:
L>
L> :0
L> * ^Content-type:(.*/<)(multipart|html)
L> {
L>    :0Bf:
L>    * -5^0
L>    * 1^1 (<)!--
L>    | formail -A"X-Spam: more than 3 HTML comments"
L>    :0ABf
L>    | sed -e 's/Content-type/Content-untype/g'
L> }

 This is how I'd rewrite that (got to warn you all, though, it's noon and I
haven't slept yet, so it's possible that I'm messing things up a wee bit;
going to get some slept as soon as I've seen this e-mail, and then I'm going
to read your replies when I wake up and say "oh, of course, why did I make
such a stupid mistake" ;-D):

:0f
* ^Content-type:(.*/<)(multipart|html)
* -5^0
* 1^1 B ?? (<)!--
| formail -A"X-Spam: 5+ HTML-comments" -i"Content-Type: text/plain"

L> That Content-type substitution should be case insensitive.  I forget
L> how to do that gracefully.

 Using GNU sed it is the I modifier, but since that's a GNUism there is no
portable way of doing it with sed; and why mess up the whole body of the e-mail
when changing a header will give the same result?!?


-- 
      /\___/\                                              /\___/\
      \_@ @_/                                              \_@ @_/
 +--oOO-(_)-OOo------------------------------------------oOO-(_)-OOo--+
 | Per scientiam ad libertatem! // Through knowledge towards freedom! |
 +---ôôô---ôôô--------------------------------------------ôôô---ôôô---+
     \O/   \O/      (c)1998-2003  tony(_at_)svanstrom(_dot_)com      \O/   \O/


_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail