procmail
[Top] [All Lists]

Re: Base64 Spam.

2003-06-13 14:51:12
On Fri, Jun 13, 2003 at 02:00:11PM -0700, 
multimedia-fan(_at_)myrealbox(_dot_)com
wrote:

On Fri, 13 Jun 2003 09:17:55 +0200, Dallman Ross <dman(_at_)nomotek(_dot_)com>
wrote:

    :0:
    * B ?? ^Content-Type:(.*\<)?text/.*\
              ^Content-Transfer-Encoding:(.*\<)?base64
    $base64spam-body


OK, this will fail on messages with no Content-Transfer headers, which
I have seen lots of messages with such mess.

No, not at all.  This recipe does not even look at the message headers.

Here is a sample I tested.


Spam Message:

[deleted except for relevant body part]

------=_NextPart_000_00E3_01B14A3A.E0116B77
Content-Type: text/html;
      charset="iso-8859-1"
Content-Transfer-Encoding: base64


PEhUTUw+PEZPTlQgQ09MT1I9IiMwMDAwMDAiIFNJWkU9MyBGQU1JTFk9IlNB
TlNTRVJJRiIgRkFDRT0iQXJpYWwiIExBTkc9IjAiPjxGT05UIENPTE9SPSIj
ZmZmZmYiPjE0MTY3MDc3MzcyMTc4MTQzMjgxODc1MjUwNzM3MzM3Njg2MzA2


Here is the log.

procmail: No match on
"^Content-Type:(.*\<)?text/.*^Content-Transfer-Encoding:(.*\<)?base64"


Of course I can understand why this happened in this message, since
you were looking for the header.

Well, no, your interpretation of the log isn't correct, because
the recipe is not looking at the header at all.

The recipe failed because the "charset=" line got in the way of a
match.  I had assumed it would be wrapped, but that was a false
assumption.  Only continuation *header* lines are wrapped; not
logically continuing lines in the body.  Change the condition to
this, and it should work:

   * B ?? ^Content-Type:(.*\<)?text/.*(^.*)?\
          ^Content-Transfer-Encoding:(.*\<)?base64

In fact, it does work; I just tested it on your message fragment.

-- 
dman

_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>