Dallman Ross wrote:
> On Wed, Apr 02, 2003 at 08:34:41PM -0700, Daryle A. Tilroe wrote:
>
>>It is, of course, trivial to construct a message
>>with a different, or empty, plain text section and
>>still have the obtusificated html spam (again
>>I have not seen this yet but it seems an obvious
>>extension)... Hmmmm.
>
>
> I had it happen early this week, and created a weighted condition to
> handle it:
>
> * $ 6^0 ^Content-T[^$WS]+:[^:]+(^[$WS]*)+------=_NextPart_
>
I see a few problems with that regexp in terms of
generalization and the feasibility as a whole.
For one think the boundary string does not need to
contain "_NextPart_". It could also have lines in
between or plain innocuous plain text content before
the boundary.
See simplified example below.
I guess what I am saying is that there is probably no
simple way of protecting against obtusificated html
that has a reasonably valid, if unrelated, plain text
part. One would have do some basic html rendering
first. I guess you could weight against excessive
html comments (<!--.*-->) but then they could just
break things up with redundant formatting commands
instead. I think the spammers may have us on this one.
--
Daryle A. Tilroe
------------------------------------------------------------
*Message-ID: <3E8AF8BD(_dot_)30100(_at_)micralyne(_dot_)com>
*Date: Wed, 02 Apr 2003 07:50:37 -0700
*From: "Daryle A. Tilroe" <daryle(_at_)micralyne(_dot_)com>
*MIME-Version: 1.0
*To: daryle <daryle(_at_)micralyne(_dot_)com>
*Subject: html test
*Content-Type: multipart/alternative;
* boundary="------------090000040406000708090209"
*
*
*--------------090000040406000708090209
*Content-Type: text/plain; charset=us-ascii; format=flowed
*Content-Transfer-Encoding: 7bit
*
*ANY OLD TEXT OR NOTHING AT ALL
*
*--------------090000040406000708090209
*Content-Type: text/html; charset=us-ascii
*Content-Transfer-Encoding: 7bit
*
*<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
*<html>
*<head>
*
*OBTUSIFICATED HTML HERE
*
*</body>
*</html>
*
*--------------090000040406000708090209--
-----------------------------------------------------------
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail