Am 2004-10-23 18:19:26, schrieb Dallman Ross:
I don't know if that's good or not; but an appraoch with base64-decode seems
promising to me. Here it is on whatever of my recent spam has encoded
Subject lines, as a test. (I don't have any legit mail of that sort at
the moment.)
First, let's see which candidates are there (out of my last-100 spam pile):
[217.86.0.207 -> panix5] {dman} [0.76]
6:11pm [~/Mail/.myspam] 292[0]> grep -i '^Subject:.*?=' *
msg.0lvB:Subject: =?utf-8?q?Rolex, Cartier, Fran?=
msg.JGCN:Subject:
=?iso-8859-1?b?Q2hlYXAgTGV2aXRyJWEgQ2lhbGklcyBhbmQgTW9yZSE=?=
msg.RGCN:Subject:
=?iso-8859-1?B?R2V0IHlvdXIgcHJlcyFjcmlwdGlvbiBkZWxpdmVyZWQgdG8geW91ciBkb29yISAgICAgOGo=?=
msg.VGCN:Subject:
=?ISO-8859-1?B?RmFzdGVzdCBEZWxpdmVyeSBOYXRpb253aWRlICAgICBx?=
msg.WGCN:Subject: =?utf-8?q?All remedy at 0.22$ ?=
Oops...
After checking I have seen it too...
All right, now let's parse those with gsed (for the case-insensitive switch)
and base64-decode:
[217.86.0.207 -> panix5] {dman} [0.54]
6:11pm [~/Mail/.myspam] 293[0]> foreach s ( `grep -i -l '^Subject:.*?=' *` )
foreach? cat $s | gsed -n '/^Subject: */I { s///; s/=[?][^?]*[?][BQ][?]//I;
p; }' | base64-decode; echo ""
OK, I have changed my procmail rule
:0 fhw
* ^Subject:.*(=?iso-8859-1?b?)
{
SUB=`formail -zxSubject: | sed -e s/=?.*[ISO8591-]?.*[bB]?// -e s/?=//
|base64-decode`
:0
| formail -i $SUB
}
OK, I think this works for "base64" (?b?)
but how about "quoted-printable" (?q?) ?
So most of them worked okay.
Not sure how that would work on the German diacriticals -- maybe it wouldn't
work.
Greetings
Michelle
--
Linux-User #280138 with the Linux Counter, http://counter.li.org/
Michelle Konzack Apt. 917 ICQ #328449886
50, rue de Soultz MSM LinuxMichi
0033/3/88452356 67100 Strasbourg/France IRC #Debian (irc.icq.com)
signature.pgp
Description: Digital signature
____________________________________________________________
procmail mailing list Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail