On Tue, Feb 22, 2022 at 10:09:02PM -0500, Alex wrote: > Hi, > The sa_mail_body_size_limit variable is to stop scanning when the > message body is larger than a certain size, but what about > attachments? Is there a variable to skip processing messages that > contain attachments larger than a specific size? > > Somehow I found a message with an 8MB attachment in the quarantine > because of a false positive. Of course I need to fix the FP, but > there's also no reason to scan such a large message.
Uhh.. - Attachments _are_ part of the MIME email message body. Everything is included in $sa_mail_body_size_limit. - $sa_mail_body_size_limit is not a hard limit, larger messages are truncated to that size, and passed to SA anyway. There is no need to skip any messages with newer SA versions.
