Hello,
We are seeing some web-logs where links from an email are being followed
back to our server, except the links are being truncated and the user-agent
is http://www.clamav.net/. Also it seems that ampersands in the parameters
are being eaten before the links are followed.
For example, an email containing the link
http://www.example.com/someAction?userid=10
<http://www.example.com/someAction?userid=10&name=bob&action=join>
&name=bob&action=join
gets turned into
http://www.example.com/someAction?userid=10name=bob
I'm not sure if this is related to clamav or not but it is in the user-agent
field. Does clamav follow links in scanned emails? I can think of any
number of reasons why this is a bad idea, not least of which is you don't
know what following those links DOES, but if it is going to follow links,
wouldn't it make sense to follow them correctly?
Anyway, this may not be clamav at all, but if anyone has any info on this,
please let me know.
Thanks,
Mark
_______________________________________________
http://lurker.clamav.net/list/clamav-users.html
