http://bugzilla.spamassassin.org/show_bug.cgi?id=3781
------- Additional Comments From [EMAIL PROTECTED] 2004-09-16 06:34 ------- Subject: Re: There should be a rule type for mime part headers -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > It's not even named MSExec in my tree anymore. I'm still tweaking it, > though. It's becoming a plugin for doing MIME tests, I'm not sure what > the exact scope is going to be, but right now, it tests the decoded MIME > part data for file(1)-style functionality. Writing a plugin for just > MSExec satisfies a long-standing bug, but it has easily become a much > more generally useful plugin without the hard-coded values in the .pm. > > I'm still playing with the format, but it might be something like this: > > loadplugin Mail::SpamAssassin::Plugin::Binary > > magic MICROSOFT_EXECUTABLE (0, 'MZ') > magic MICROSOFT_EXECUTABLE (128, 'PE\x00\x00') > body MICROSOFT_EXECUTABLE eval:check_binary() > > magic PNG_IMAGE (0, '\x89PNG') > body PNG_IMAGE eval:check_binary() > > Don't worry too much about the format. sounds like a good plan. don't fear adding a new test type -- that should (a) be easy enough, (b) be modular enough now that it's in a plugin anyway and (c) be faster than eval code. > >> 2. we could clean up the header test types a bit and allow something > >> like "full" on just the body. > > > Not sure how that effects MIME part headers? > > A stupid line-by-line pristine raw untouched undecoded unrendered body > test would be sufficient for 99% of MIME header tests, especially of the > type desired by most rule writers. however, there are problems there. for example, (a) there would be no way to tell a Content-Foo: line *inside* a MIME part, from a Content-Foo: line in a MIME part's header. (b), efficiency may not be so hot when you consider large messages. (c), MIME headers can span multiple lines, so passing the "full-full" text line-by-line wouldn't work there. > I wasn't even close to suggesting that we make people write an eval > test. ok. - --j. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.4 (GNU/Linux) Comment: Exmh CVS iD8DBQFBSZZ0QTcbUG5Y7woRAoz8AKCGGAPgNOYJ5KUOVeF53LPZ8AvY6gCeKPJX tBm/KJT+m+X8N/LNUxwCAJQ= =Cr6B -----END PGP SIGNATURE----- ------- You are receiving this mail because: ------- You are the assignee for the bug, or are watching the assignee.
