procmail
[Top] [All Lists]

Re: Procmail filter sometimes failed...

2008-08-19 13:17:23
On Tue, Aug 19, 2008 at 12:47:48PM -0300, josias gonçalves wrote:

:0 H
*^Content-type: (multipart/mixed)
{

    :0 B
     *^Content-Disposition: (attachment|inline)
     
*filename=".*\.(ocx|ade|adp|bas|bat|chm|cmd|com|cpl|crt|dll|exe|eml|hlp|hta|htt|inf|ins|isn|isp|js|jse|lnk|mdb|mde|msc|msi|msp|mst|pcd|pif|reg|sc|scr|sct|shb|shs|vb|vbe|vbs|pps|pptx|ppsx|ppt|wsc|wsf|wma|wmv|avi|mp3|mp4|mpeg|mpg|mov|qiv|asf|mpe|wsh)"
     {
        :0
        /var/mail/attach
     }

}

if something attach is found, the e-mail will to /var/mail/attach
so, some e-mails, like one today (one with pps extension), pass
trought this rule.
is something wrong ? with this rule... thanks.

The simple answer is, it's not always that simple.  For example, there
could be faux or actual daemon bounces without the Content-Type header
but with the nasty thing in the body.

Instead of re-inventing the wheel, you could try my Virus Snaggers(tm).
I haven't touched the code in a few years, but it still works, and
people, and I, still use it to good result.

It's easy to tell it to use exactly the extensions you have chosen above.

 http://vsnag.spamless.us

Dallman
____________________________________________________________
procmail mailing list   Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>