http://bugzilla.spamassassin.org/show_bug.cgi?id=4176





------- Additional Comments From [EMAIL PROTECTED]  2005-05-06 13:12 -------
I see a basic design issue here. Going all the way back to the spamassasssin
script, processing looks like this, as a rough outline:
  
   $mail = Mail::SpamAssassin->parse( message text )
   $results = Mail::SpamAssassin->check($mail)

Until now everything that parse() has done has been independent of _any_
configuration options. That makes parse() something that understands the RFC
standard email, MIME, and HTML formats, but acts as a standalone library.

Unless we change that design, the redirection pattern code _has_ to be done
during the call to check(), using the deobfuscated URis that are parth of the
$mail object that parse() returns.

In the design we have been using in these patches we think about the problem
like this: Spammers use redirection as a way to obfuscate the URLs they are
sending you to. We find the target URLs in our deobfuscation routine.

Treating redirection patterns as just another form of obfuscation (#0) won't
work because 1) we want to have the flexibility of placing the patterns in a
configuration file; 2) parse() behaviour is independent of any configuration
file; 3) deobfuscation is performed in parse().

To get this to work we change any one of the four numbered items in the previous
paragraph. I think the easiest to change is #0, by performing the redirection
pattern stuff in check(), not in parse(). Changing #3 is what I did with the
patch I submitted -- It is not a lot of code change, but it is a fundamental
design change to parse().

The problem with doing redirection patterns in check() is that we want this to
act as a filter on all URIs before they are passed to all other processing in
check(). Do we have a place to put that in? Is that the change to the plugin API
that you were talking about, Daniel, to have a way of inserting a filter before
all other processing, or at least a filter on the URI list?



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
You are on the CC list for the bug, or are watching someone who is.

Reply via email to