procmail
[Top] [All Lists]

Re: Base64spam eliminated!

2005-09-23 08:14:41
Louis N Proyect schreef:

the thing I could never understand is why a simple filter on
the presence of "Content-Transfer-Encoding: base64" failed to work.

If you are specifically disinterested in any message that has a
base64-encoded part announced in the message header, then it is simple:

  :0
  * ^Content-Transfer-Encoding: base64$
  /dev/null


Too a simple filter would catch your message, and my reply too:

  :0B:  # beware, this recipe is evil
  * Content-Transfer-Encoding: base64
  .spam-base64


This is less bad:

  :0B:
  * 9876543210^0 ^Content(-[a-z]+)+:.*$Content-Transfer-Encoding:
base64$
  * 9876543210^0 ^Content-Transfer-Encoding: base64$Content(-[a-z]+)+:
  .spam-base64

because it requires another Content-header right next to it, But that is
not always there, so it will miss some.


Another approach:

  :0B:
  * ^$--[^ ]*($.+)*^Content-Transfer-Encoding: base64$
  .spam-base64

that looks for an empty line, followed by what looks like a
MIME-boundary, etc.


All these variants are not perfect, so they "only" fail to work
sometimes.

-- 
Grtz, Ruud


____________________________________________________________
procmail mailing list   Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>