Another method.
The content header field is defined to have these values for the type.
header J_BAD_CONTYPE Content-Type !~
/^(application|audio|image|message|multipart|text|video|x-)/i
score J_BAD_CONTYPE 0.1
describe J_BAD_CONTYPE invalid content type declared in header of the message
Jim
----- On Nov 8, 2017, at 11:15 AM, Bill Cole
sausers-20150...@billmail.scconsult.com wrote:
> On 8 Nov 2017, at 14:12, Bill Cole wrote:
>
>> On 8 Nov 2017, at 11:16, Dianne Skoll wrote:
>>
>>> On Wed, 8 Nov 2017 11:02:16 -0500
>>> Rob McEwen <r...@invaluement.com> wrote:
>>>
>>>> This seems to be catching most of them:
>>>
>>>> Subject: Invoice [A-Z]{2,3}\d{7}\b
>>>
>>> Yes, that'll work. Maybe a better approach is a combo rule that
>>> looks
>>> in the headers for Content-Type: .*art/mixed but NOT multipart/mixed
>>>
>>> I don't know offhand how to create such a rule in SpamAssassin, but I
>>> imagine
>>> a meta rule could take care of it.
>>
>> Untested:
>>
>> description SCC_MIME_BOGUSCT1 Bogus /mixed Content-Type
>> header SCC_MIME_BOGUSCT1 Content-Type =~
>> /^(?<!multipart)\/mixed/
>> score SCC_MIME_BOGUSCT1 2
>
> Of course that should be:
>
> describe SCC_MIME_BOGUSCT1 Bogus /mixed Content-Type
> header SCC_MIME_BOGUSCT1 Content-Type =~ /^(?<!multipart)\/mixed/
> score SCC_MIME_BOGUSCT1 2
--
Jim Dunphy Victoria: (250) 665 8066
Aesir Computing, Inc. USA: (703) 406 8062
CTO Mobile: (206) 480-6069
1215 Royal Oak Dr Twitter: medhatjad
Victoria, BC V8X 3T7 www.aesir.com
