On 7/23/26 2:14 PM, pgnd wrote:
i run spamassassin -V SpamAssassin version 4.0.2 running on Perl version 5.42.2 it's invoked as a milter in my postfix setup. a phish just snuck by ... once submitted to Bayes and re-scanned, it *is* pushed over threshhold. i'm looking at why it snuck by in the first place. there _is_ a phishing URL, deeply embedded; my current setup fails to find/act-on it. the message structure MIME tree has two parts, nothing suspicious on the surface: multipart/related |-- text/html |-- application/octet-stream base64, filename=DHL_SHIPPING_LETTER.html the phishing URL is not obviously in that MIME tree. it's buried inside that octet-stream attachment -- 4 decode steps deep. my SA missed it. manually, i can grab it (1) base64-decode the attachment --> an HTML document (2) read its <embed src="data:...pdf;base64,..."> --> data: URI (3) base64-decode that data: URI --> a PDF (4) read the PDF's /URI link annotation --> the phishing URL i.e., the phising URL sits four layers down: MIME part --> base64 --> HTML --> data: URI --> base64 --> PDF --> /URI annotation. SA sees only that first, single opaque attachment. it never performs the four in-payload decodes. how to config SA 4.0.x to find/exctract that "deep" URL? iiuc, neither out-of-the-box ExtractText nor OLEVBMacro are sufficient? is a custom, multi-step ExtractText extractor script needed? e.g., that: decodes the octet-stream HTML pulls the data:application/pdf;base64 blob base64-decodes it extracts the PDF /URI annotation emits the URLs as actionable plain text ? or is there something that already exists? is chained/recursive extraction configurable in ExtractText, or other?
you can write a shell script that does that
even once you reach the PDF, running pdftotext via ExtractText doesn't appear to emit /URI link annotations. it can't surface the URL. i think pdftohtml/mutool could, but pdftohtml emits HTML, which ExtractText documents as unsupported output,
maybe `pdftohtml` + `lynx -dump` might work Cheers Giovanni
@ https://spamassassin.apache.org/full/4.0.x/doc/Mail_SpamAssassin_Plugin_ExtractText.html "... External tool must output plain text, not HTML or other non-textual result. ..."
OpenPGP_signature.asc
Description: OpenPGP digital signature
