Re: BANNED contents (.image, .png, image001.png) in mail FROM [192.0.2.0]:48963

[Mark Martinec]

ben,

i'm getting the following notifications:

Subject: BANNED contents (.image,.png,image001.png) in mail FROM 
[192.0.2.0]:48963

No viruses were found.

Banned name: .image,.png,image001.png
Content type: Banned
Internal reference code for the message is 07049-20/tsuDhcN5qlnc

[...]
The message has been quarantined as: t/banned-tsuDhcN5qlnc

but i'm having trouble figuring out why these contents were banned.  i don't 
intentionally have things configured this way.  here are my current settings i 
believe are related to this?:

$banned_filename_re = new_RE(
        qr'^UNDECIPHERABLE$',   # is or contains any undecipherable components

        # block certain double extensions anywhere in the base name
        
qr'\.[^./]*[A-Za-z][^./]*\.\s*(bat|cmd|com|cpl|dll|exe|pif|reg|scr|vbs)[.\s]*$'i,

        # allow any file types within such archives
        [ qr'^\.(Z|gz|bz2)$'                            => 0 ],      # 
unix-compressed
        [ qr'^\.(rpm|cpio|tar)$'                        => 0 ],      # unix 
archives
        [ qr'^\.(zip|rar|arc|arj|zoo)$'                 => 0 ],      # 
other/misc

        # rudimentary extension blocking [based on file name alone]
        # note: extensions added here should also have entries for mime or
        # file types below, where possible
        qr'.\.(bat|cab|cmd|com|cpl|dll|exe|lha|mis|pif|reg|scr|vbs|wsf|wsh)$'i,

        # mime types to block
        qr'^application/x-msdownload$'i,
        qr'^application/x-msdos-program$'i,
        qr'^application/hta$'i,

        # don't allow attachments spread out across multiple messages [rfc2046]
        qr'^message/partial$'i,
        qr'^message/external-body$'i,

        # files types to block [as per file(1)]
        qr'^\.(cab|dll|exe|exe-ms|lha|tnef)$',

        # blocks attachments whose names contain clsid extensions
        qr'\{[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}\}?'i,    # strict
        #qr'\{[0-9a-z]{4,}(-[0-9a-z]{4,}){0,7}\}?'i,            # loose
);

what am i missing?

The macro %F (producing: .image,.png,image001.png) just shows a
leaf note of the MIME and archives tree. A banning reason may
be in one of its parents, e.g. a MIME type or a type of an
archive (like zip).

Search the log (log level 1) for ' p.path' corresponding to that
mail message, it will show a more detailed information on the
banning reason.

  Mark