procmail
[Top] [All Lists]

Re: Search in a Attachment - Procmail

2008-11-10 13:36:27
On Mon, Nov 10, 2008 at 06:00:11PM +0100, Andreas Drastig wrote:

But now when an attachment is, then searched procmail even after
this "test" but this should not happen, is this possible?

The attachments are encoded.  They are most likely base64- or uu-encoded.

Procmail views the raw stream of message characters.  The only way
to see translated values of encoded files is to decode them.  This
is generally out of procmail's purview.  But you can use procmail
to pipe the message to a MIME-/uudecoder and view the results.  Check
the searchable archives of this list for some tips and ideas on doing
that.

You could alternatively look for the raw string-variants that might
decode to "test" once a message is decoded.  But there are three
variants for each identically-cased string.  And the ways to
mix capitals and small letters for a four-letter word are ...
quite a few (4**2):

  bash-3.2$ for L1 in T t; do for L2 in E e; do for L3 in S s; do for L4 in T 
t; do echo $L1$L2$L3$L4; done; done; done; done             
  TEST
  TESt
  TEsT
  TEst
  TeST
  TeSt
  TesT
  Test
  tEST
  tESt
  tEsT
  tEst
  teST
  teSt
  tesT
  test
  
Each of those has three different base64 variants.  And then, what if
it's uuencoded instead of base64-encoded?

For amusement: here are what some of the MIME encodings will look like:

bash-3.2$ for pad in '' x xx xxx; do for L1 in T t; do for L2 in E e; do for L3 
in S s; do for L4 in T t; do echo $pad$L1$L2$L3$L4 | base64; done; done; done; 
done; done | sed 's/.*\(.........\)$/\1/' | sort -u | fmt
RVN0Cg== RVNUCg== RXN0Cg== RXNUCg== VEVTVAo= VEVTdAo= VEVzVAo=
VEVzdAo= VGVTVAo= VGVTdAo= VGVzVAo= VGVzdAo= ZVN0Cg== ZVNUCg==
ZXN0Cg== ZXNUCg== dEVTVAo= dEVTdAo= dEVzVAo= dEVzdAo= dGVTVAo=
dGVTdAo= dGVzVAo= dGVzdAo= eFRFU1QK eFRFU3QK eFRFc1QK eFRFc3QK
eFRlU1QK eFRlU3QK eFRlc1QK eFRlc3QK eHRFU1QK eHRFU3QK eHRFc1QK
eHRFc3QK eHRlU1QK eHRlU3QK eHRlc1QK eHRlc3QK

Dallman
____________________________________________________________
procmail mailing list   Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>