Dear Matt:
>> it would be a bug in Declude to behave
in this way <<
You may be right - but I'm not that certain
about that being a bug (unless you expect Declude to perform a "syntax
check" of these user headers).
RFC822 states:
3.1.1. LONG HEADER FIELDS
Each header field can be viewed as a single, logical line of
ASCII characters, comprising a field-name and a field-body.
For convenience, the field-body portion of this conceptual
entity can be split into a multiple-line representation; this
is called "folding". The general rule is that wherever there
may be linear-white-space (NOT simply LWSP-chars), a CRLF
immediately followed by AT LEAST one LWSP-char may
instead be
inserted.
In other words, as long as CRLF is followed by a
SPACE in the new line, the line
X-Spam-Tests-Failed
Weight
would have to be treated as a conintuation of
the PRIOR header field.
However, in the absence of:
a) a leading space,
b) a valid header field name
it might actually be PROPER to err on the side
of safety and consider this the "end" of the headers.
After all, we don't want to create a
vulnerability where someone could insert "data" into the header that
Outlook might skip...
Best Regards
Andy Schmidt
Phone: +1 201 934-3414 x20
(Business)
Fax: +1 201 934-9206
Fred,
Those are all legit. Andy has keen eyes and I suspect that he may have
identified the trigger, though it would be a bug in Declude to behave
in this way, but a minor one.
The examples that you gave all have no spaces prior to the first colon,
and that is compliant. The one that Andy gave was clearly not, and it
is the one that is also causing you problems.
Matt
Frederick Samarelli wrote:
Good Thought but I have these
others without problem. Thanks.
XINHEADER X-Note: Total spam
weight of this E-mail is %WEIGHT%.
XINHEADER X-RBL-Warning: Total weight: %WEIGHT%
XINHEADER X-Note: This E-mail was scanned & filtered by TCB
[%VERSION%] for SPAM & virus.
XINHEADER X-Note: Sent from: %MAILFROM%
XINHEADER X-Note: Sent from Reverse DNS: %REVDNS% ([%REMOTEIP%])
XINHEADER X-Note: Recipient(s): %REALRECIPS%
----- Original Message -----
Sent:
Wednesday, April 13, 2005 4:02 PM
Subject:
RE: [Declude.JunkMail] Something new with v 2.0.6
Hi Frederick:
I don't know if this has been asked/suggested
already and I don't have time to go back to the RFCs to see if embedded
spaces are permitted in the header name. But have you ever tried
eliminating that space:
XINHEADER X-Spam-Tests-Failed
Weight: %TESTSFAILEDWITHWEIGHTS%
replace with:
XINHEADER X-Spam-Tests-Failed-Weight:
%TESTSFAILEDWITHWEIGHTS%
May be the problem is that there is a CR/LF
followed by a line that contains no header name (due to the embedded
space) following by another CR/LF. May be those two CR/LF without
valid header information inbetween are interpreted as "start of message
body" by some entities?
Best Regards
Andy Schmidt
Phone: +1 201 934-3414
x20 (Business)
Fax: +1 201 934-9206
Mike/Matt (thanks
for your help) You should be able to duplicated by just forwarding an
email to an outside account using the problem line at the bottom.
As not to confuse
things I simplified the process.
This run through
only one server on my network.
Header
from My AOL account.
Return-Path: <[EMAIL PROTECTED]>
Received: from rly-xm04.mx.aol.com (rly-xm04.mail.aol.com
[172.20.83.105]) by air-xm03.mail.aol.com (v105.26) with ESMTP id
MAILINXM31-606425d743d132; Wed, 13 Apr 2005 15:34:25 -0400
Received: from bks.tcbinc.com (bks.tcbinc.com [64.124.117.196]) by
rly-xm04.mx.aol.com (v105.26) with ESMTP id
MAILRELAYINXM42-606425d743d132; Wed, 13 Apr 2005 15:34:21 -0400
Received: from SMTP32-FWD by bks.tcbinc.com
(SMTP32) id A741100040470EC67; Wed, 13 Apr 2005 15:33:42
Received: from web51806.mail.yahoo.com [206.190.38.237] by
bks.tcbinc.com
(SMTPD32-8.15) id A41140470; Wed, 13 Apr 2005 15:33:37 -0400
Received: (qmail 50369 invoked by uid 60001); 13 Apr 2005 19:34:12 -0000
Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
b=M12dWrk8x99pS4FhLTVJbfbgIc60YrjkjS/Vi2yiCoare5X2fk5F+zDzAA2XuOKAyAuKoj3EEGBHc6gPlwybZ/TMSShXoJtIypUpKUZZrm7SoU0rx30hedmPe9IecDArBynamRJFf8HjmCsGFKGIwJhKUjwV4wNnw1wLdarF7SE=
;
Message-ID: <[EMAIL PROTECTED]>
Received: from [64.124.117.139] by web51806.mail.yahoo.com via HTTP;
Wed, 13 Apr 2005 12:34:12 PDT
Date: Wed, 13 Apr 2005 12:34:12 -0700 (PDT)
From: Frederick Samarelli <[EMAIL PROTECTED]>
Subject: test10
To: [EMAIL PROTECTED]
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
X-RBL-Warning: SNIFFERZERO: Message failed SNIFFERZERO: 0.
X-Declude-Sender: [EMAIL PROTECTED]
[206.190.38.237]
X-Declude-Spoolname: D741100040470EC67.SMD
X-Note: Total spam weight of this E-mail is 0.
X-RBL-Warning: Total weight: 0
X-Note: This E-mail was scanned & filtered by TCB [2.0.6] for SPAM
& virus.
X-Spam-Tests-Failed: SNIFFERZERO
Message
Body (should only be the word test10)
X-Spam-Tests-Failed Weight: SNIFFERZERO [0]
X-Spam-Time:15:33:42
X-Weight: 0
X-Mailfrom: samarelli.yahoo.com
X-Note: Sent from:
[EMAIL PROTECTED]
X-Note: Sent from Reverse DNS: web51806.mail.yahoo.com
([206.190.38.237])
X-Hello: web51806.mail.yahoo.com
X-Note: Recipient(s):
[EMAIL PROTECTED]
X-Country-Chain: UNITED STATES->destination
X-AOL-IP: 64.124.117.196
X-AOL-SCOLL-SCORE:0:0:0:
X-AOL-SCOLL-URL_COUNT:0
test10
Culprit:
XINHEADER X-Spam-Tests-Failed
Weight: %TESTSFAILEDWITHWEIGHTS%
--
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================
