http://bugzilla.spamassassin.org/show_bug.cgi?id=3781





------- Additional Comments From [EMAIL PROTECTED]  2004-09-16 03:26 -------
Subject: Re:  There should be a rule type for mime part headers 

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


> I think this can be handled in one of two ways:
> 1. the MIME-ish "Binary" plugin I'm working on based on MSExec could do
>    this in addition to what I'm working on now (accessing raw MIME part
>    data)

- -0: that doesn't make much sense; why would a plugin intended to
detect MS executables, also allow third-parties to match against
arbitrary data in MIME part headers?   that usage isn't exactly
suggested by the name/purpose of "MSExec".

However making the MSExec plugin depend *on* another plugin that
allows this, now *that* makes sense.

> 2. we could clean up the header test types a bit and allow something
>    like "full" on just the body.

Not sure how that effects MIME part headers?

> I think I would probably object to a new core test type for just MIME
> part headers.

I think we have a significant "blind spot", in that we currently have no
way for a rule to match against those part headers -- apart from writing
an eval rule.

I think we may even have a situation where we *could* match some
spam through a rule that did that, and we're just not looking yet.

I don't think being able to access them in an eval rule is good enough,
btw.  That's too high a jump to make for most rule authors; it requires
familiarity with the code a lot more than writing a rule does.  We
shouldn't require that rule authors know how to write eval tests.   In
addition, eval tests are slower than a native rule type.

(Eval tests shift quite a lot of parsing overhead from startup-time to
runtime -- due to the overhead of argument marshalling, an individual eval
' ' scope for the function call, etc.  Quite a lot slower than the other
rule types.  take a look at DProf output...)

So I think we do need some way for user rules to access this code.

I'd be in favour of a plugin that implements this new rule type.

- --j.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh CVS

iD8DBQFBSWpVQTcbUG5Y7woRAliiAKCHtsJ0MjkA4Tk/c5bwzlERCFtpsACeIZYw
fMDh44CdVBK3WK3QSyNGM68=
=53Pn
-----END PGP SIGNATURE-----





------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

Reply via email to