Dear
Matt:
>> it would be a
bug in Declude to behave in this way <<
You
may be right - but I'm not that certain about that being a bug (unless you
expect Declude to perform a "syntax check" of these user
headers).
RFC822
states:
3.1.1. LONG HEADER
FIELDS
Each header field can
be viewed as a single, logical line
of
ASCII characters,
comprising a field-name and a
field-body.
For convenience, the
field-body portion of this
conceptual
entity can be
split into a multiple-line representation;
this
is called "folding".
The general rule is that wherever
there
may be
linear-white-space (NOT simply LWSP-chars), a CRLF
immediately
followed by AT LEAST one LWSP-char may instead
be
inserted.
In
other words, as long as CRLF is followed by a SPACE in the new line, the line
X-Spam-Tests-Failed Weight
would
have to be treated as a conintuation of the PRIOR header
field.
However, in the absence of:
a) a
leading space,
b) a
valid header field name
it
might actually be PROPER to err on the side of safety and consider this the
"end" of the headers.
After
all, we don't want to create a vulnerability where someone could insert
"data" into the header that Outlook might skip...
Best
Regards
Andy Schmidt
Phone: +1 201 934-3414 x20
(Business)
Fax: +1 201 934-9206
Fred,
Those are all legit. Andy has
keen eyes and I suspect that he may have identified the trigger, though it
would be a bug in Declude to behave in this way, but a minor one.
The
examples that you gave all have no spaces prior to the first colon, and that
is compliant. The one that Andy gave was clearly not, and it is the one
that is also causing you problems.
Matt
Frederick
Samarelli wrote:
Good Thought but I have these others without
problem. Thanks.
XINHEADER X-Note: Total spam weight
of this E-mail is %WEIGHT%.
XINHEADER X-RBL-Warning:
Total weight: %WEIGHT%
XINHEADER X-Note: This E-mail was
scanned & filtered by TCB [%VERSION%] for SPAM &
virus.
XINHEADER X-Note: Sent from:
%MAILFROM%
XINHEADER X-Note: Sent from Reverse DNS:
%REVDNS% ([%REMOTEIP%])
XINHEADER X-Note: Recipient(s):
%REALRECIPS%
----- Original Message -----
Sent:
Wednesday, April 13, 2005 4:02 PM
Subject:
RE: [Declude.JunkMail] Something new with v 2.0.6
Hi Frederick:
I don't know if this has been asked/suggested already and I don't
have time to go back to the RFCs to see if embedded spaces are permitted
in the header name. But have you ever tried eliminating that
space:
XINHEADER X-Spam-Tests-Failed
Weight: %TESTSFAILEDWITHWEIGHTS%
replace with:
XINHEADER X-Spam-Tests-Failed-Weight:
%TESTSFAILEDWITHWEIGHTS%
May be the problem is that there is a CR/LF followed by a line that
contains no header name (due to the embedded space) following by
another CR/LF. May be those two CR/LF without valid header
information inbetween are interpreted as "start of message body" by some
entities?
Best Regards
Andy Schmidt
Phone: +1 201 934-3414 x20
(Business)
Fax: +1 201 934-9206
Mike/Matt (thanks for your help)
You should be able to duplicated by just forwarding an email to an
outside account using the problem line at the
bottom.
As not to confuse things I
simplified the process.
This run through only one server on
my network.
Header from My AOL
account.
Return-Path: <[EMAIL PROTECTED]>
Received:
from rly-xm04.mx.aol.com (rly-xm04.mail.aol.com [172.20.83.105])
by air-xm03.mail.aol.com (v105.26) with ESMTP id
MAILINXM31-606425d743d132; Wed, 13 Apr 2005 15:34:25 -0400
Received:
from bks.tcbinc.com (bks.tcbinc.com [64.124.117.196]) by
rly-xm04.mx.aol.com (v105.26) with ESMTP id
MAILRELAYINXM42-606425d743d132; Wed, 13 Apr 2005 15:34:21
-0400
Received: from SMTP32-FWD by bks.tcbinc.com
(SMTP32)
id A741100040470EC67; Wed, 13 Apr 2005 15:33:42
Received: from
web51806.mail.yahoo.com [206.190.38.237] by bks.tcbinc.com
(SMTPD32-8.15) id A41140470; Wed, 13 Apr 2005 15:33:37
-0400
Received: (qmail 50369 invoked by uid 60001); 13 Apr 2005
19:34:12 -0000
Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys
DomainKey-Signature:
a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
b=M12dWrk8x99pS4FhLTVJbfbgIc60YrjkjS/Vi2yiCoare5X2fk5F+zDzAA2XuOKAyAuKoj3EEGBHc6gPlwybZ/TMSShXoJtIypUpKUZZrm7SoU0rx30hedmPe9IecDArBynamRJFf8HjmCsGFKGIwJhKUjwV4wNnw1wLdarF7SE=
;
Message-ID: <[EMAIL PROTECTED]>
Received:
from [64.124.117.139] by web51806.mail.yahoo.com via HTTP; Wed, 13 Apr
2005 12:34:12 PDT
Date: Wed, 13 Apr 2005 12:34:12 -0700
(PDT)
From: Frederick Samarelli <[EMAIL PROTECTED]>
Subject:
test10
To: [EMAIL PROTECTED]
MIME-Version:
1.0
Content-Type: text/plain; charset=us-ascii
X-RBL-Warning:
SNIFFERZERO: Message failed SNIFFERZERO: 0.
X-Declude-Sender: [EMAIL PROTECTED]
[206.190.38.237]
X-Declude-Spoolname:
D741100040470EC67.SMD
X-Note: Total spam weight of this E-mail is
0.
X-RBL-Warning: Total weight: 0
X-Note: This E-mail was scanned
& filtered by TCB [2.0.6] for SPAM &
virus.
X-Spam-Tests-Failed: SNIFFERZERO
Message Body (should only be the word
test10)
X-Spam-Tests-Failed Weight: SNIFFERZERO
[0]
X-Spam-Time:15:33:42
X-Weight: 0
X-Mailfrom:
samarelli.yahoo.com
X-Note: Sent from:
[EMAIL PROTECTED]X-Note:
Sent from Reverse DNS: web51806.mail.yahoo.com
([206.190.38.237])
X-Hello: web51806.mail.yahoo.com
X-Note:
Recipient(s):
[EMAIL PROTECTED]X-Country-Chain:
UNITED STATES->destination
X-AOL-IP:
64.124.117.196
X-AOL-SCOLL-SCORE:0:0:0:
X-AOL-SCOLL-URL_COUNT:0
test10
Culprit:
XINHEADER X-Spam-Tests-Failed
Weight:
%TESTSFAILEDWITHWEIGHTS%
--
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================
