> anyone know if this will work?
Yes, I know.
> /^(filename|name=".*\.*\.*\"/ REJECT trip_extension_body_check
And no, it would not.
xxxyou.htm.pif.htm is the problem
You are looking for a TON of dots.
The "fix" is an escaped dot, then anything, an excaped dot, then, anything,
an escaped dot then anything. .* is anything. . is any single character.
* is repeat last any number of times.
/^(filename|name=".*\..*\..*\..*\"/ REJECT
Or perhaps to limit it more (and thereby take less chances)
/^(filename|name=".*\..{1,3}\..{1,3}\..{1,3}\"/ REJECT
I personally use this bugger:
/^Content-Disposition: .*\..{1,3}\.(bat|com|exe|pif).*$/ REJECT Sorry,
attachment looked like a virus.
It should also trigger on your triple because the double extension happens
in there.
--Eric
