https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8494
Bug ID: 8494
Summary: Message.pm: Text attachment skip only matches
lowercase "attachment;"
Product: Spamassassin
Version: SVN Trunk (Latest Devel Version)
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Libraries
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: Undefined
Version: trunk (70be9b7dd), 4.0.x not affected
With scan_text_attachments 0, get_body_text_array_common() skips text/plain
and text/html attachments, but tests the raw header (Message.pm, line 1500):
my $cdisp = $p->{'headers'}->{'content-disposition'}[0];
if(!$self->{scan_text_attachments} and (defined $cdisp and ($cdisp =~
/^attachment;/) and ...
These are not skipped and end up in the body:
Content-Disposition: attachment
Content-Disposition: Attachment; filename="a.html"
Content-Disposition: ATTACHMENT; filename="a.html"
Content-Disposition: attachment ; filename="a.html"
$p->{'disposition'} already holds the parsed, lowercased value (set in
_parse_normal(), used by Handler::HTML).
To reproduce: multipart/mixed with a text/html part containing ZQXTOKEN and one
of the headers above, rule `body X_TOK /ZQXTOKEN/`. It hits with
scan_text_attachments 0; with `attachment; filename="a.html"` it does not.
Fix:
```diff
--- a/lib/Mail/SpamAssassin/Message.pm
+++ b/lib/Mail/SpamAssassin/Message.pm
@@ -1497,8 +1497,7 @@
# Skip text attachments that are not considered part of the email body,
# unless scan_text_attachments is enabled (e.g. to catch phishing
payloads
# delivered as attached text/html or text/plain files).
- my $cdisp = $p->{'headers'}->{'content-disposition'}[0];
- if(!$self->{scan_text_attachments} and (defined $cdisp and ($cdisp =~
/^attachment;/) and ($type =~ m{^text/(?:plain|html)$}))) {
- dbg("$method_name: Skipping text attachment with content-disposition
\"$cdisp\"");
+ if(!$self->{scan_text_attachments} and (($p->{'disposition'} // '') eq
'attachment') and ($type =~ m{^text/(?:plain|html)$})) {
+ dbg("$method_name: Skipping text attachment with content-disposition
\"$p->{'disposition'}\"");
next;
}
```
--
You are receiving this mail because:
You are the assignee for the bug.
