Re: Keyword filtering

[Bryan Scott]

Does anyone have/use a plugin outside of spamassassin that checks for UCB
common keywords?  SA will tag score some of the nasties, but not 
enough to
drop them.  I'm looking to just examine the Subject for this test.

Here's the plugin.  My implementation is a little more elaborate than this, but 
this one will do what you want.  This one also checks for "SpamCop" in the 
subject line, because I want their stuff to make it through to my abuse box.

I can send you a filter list for subjects and some viruses, but I'll do it off 
list because of the proliferation of profanities in it.  :)

-- Bryan

-----------------------
# This plugin rejects based on pattern matches in the subject
#
# Your config files are badsubject and badsubjectv
#
sub register {
  my ($self, $qp) = @_;
  $self->register_hook("mail", "mail_handler");
}
sub mail_handler {
    my ($self, $transaction, $sender) = @_;
    my $from = lc($sender->user . '@' . $sender->host);
    my $subject = $transaction->header->get('Subject');
    my @badsubject = $self->qp->config("badsubject");
    my @badsubjectv = $self->qp->config("badsubjectv");
    for my $badsubjectv (@badsubjectv) {
        if ($subject =~ /^$badsubjectv$/ and $subject !~ /SpamCop/i) {
            $self->log(4,"Message from $from matched $badsubjectv");
            return (DENY, "Message from $from looks like a virus.");
        }
    }
    for my $badsubject (@badsubject) {
        if (lc($subject) =~ /\b$badsubject\b/i and $subject !~ /SpamCop/i) {
            $self->log(4,"Message from $from matched $badsubject");
            return (DENY, "Message from $from looks like spam.");
        }
    }
    if (($subject =~ /[^A-Za-z0-9]{10,}/ || $subject =~ /^\s*ADV/) \
                     && $subject !~ /SpamCop/i) {
        return (DENY, "Message from $from looks like spam.");
    }
}