https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6439

--- Comment #3 from Karsten Bräckelmann <[email protected]> 2011-10-29 
23:41:38 UTC ---
(In reply to comment #1)
> Can you add an example email in mbox format so I can test this in various 
> MUAs?

Sure, see attachment 5001.

Testcase of two trivial multipart/mixed MIME messages, with a text/plain and
application/octet-stream attachment respectively. Other than the second MIME
part's Content-Type (and Subject), both messages are identical.

This masquerading technique is used by 419 scammers, to get the actual text
past a content scanner. Body rules, as well as Bayes should be affected. The
topic has been discussed on the users list a few times.

It appears MUAs in wide-spread use (and most likely web-mail interfaces, too)
will happily show the content of the attachment based on the file extension or
content sniffing, even with binary-indicating Content-Type.


Trivial testcase ad-hoc body rule:

  spamassassin --cf="body BUG_6439 /^Plain .*/" -D  < MSG
   2>&1 | grep BUG_6439

Only the text/plain variant will hit the body rule, and the debug output of
that greedy regex match will print the actual payload line in full. The
application/octet-stream variant will not hit that rule.

-- 
Configure bugmail: 
https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

Reply via email to