saqariden wrote:
Hi all,

lately i see more and more mails using base64 encoding for the body of the mails.

example:
[snip]
This is a spam mail, my SpamAssassin did not recognize it as spam, even if i have rules that can match the decoded body. My question is:

Is it possible to decode into TXT/HTML the encoded parts so SA can catch it ? Otherwise, how can the rule be applied to an encoded mail body?

SpamAssassin already does this, as per the man page entry for body rules in Mail::SpamAssassin::Conf:

=====

body SYMBOLIC_TEST_NAME /pattern/modifiers

Define a body pattern test. "pattern" is a Perl regular expression. Note: as per the header tests, "#" must be escaped ("\#") or else it is considered the beginning of a comment.

The 'body' in this case is the textual parts of the message body; any non-text MIME parts are stripped, and the message decoded from Quoted-Printable or Base-64-encoded format if necessary. The message Subject header is considered part of the body and becomes the first paragraph when running the rules. All HTML tags and line breaks will be removed before matching.

=====

Please post the rules you think should match on this example.

-kgd

Reply via email to