On 7/10/2005 4:41 PM, Eric A. Hall wrote: > On 7/10/2005 3:49 PM, Loren Wilton wrote: > >>However, if you want something like this, just off the top of my head: >> >>header __HAS_TO To =~/\S/ >>body __HAS_BODY /\S/ >>meta EMPTY_MSG (!__HAS_TO && !__HAS_BODY) > > Good idea. rawbody works better but the model is right.
As was pointed out off-list, this rule will wrongly fire if there is an attachment and no text body. The following rule is adapted from the suggested rules that were provided (I assume anonymity was desired from the off-list response so...). The rule checks for the presence of a nested media-type (message/ and multipart/ are the only nested types) or the presence of body data. header __L_MSG_HAS_C_TYPE_M Content-Type =~ /^(message|multipart)/i rawbody __L_MSG_HAS_BODY /\S/ describe L_MSG_NO_BODY Raw message does not have any body data meta L_MSG_NO_BODY (!__L_MSG_C_TYPE_M && !__L_MSG_BODY) score L_MSG_NO_BODY 0.1 There are lots of fancier things to look for but that is pretty minimal testing which is what I'm looking for. BTW, I am doing this so that postfix can trap the rule after the message has undergone filtering, so that the message can simply be rejected (there's no judgement as to spamminess here, just a check to see if the message has any content). -- Eric A. Hall http://www.ehsco.com/ Internet Core Protocols http://www.oreilly.com/catalog/coreprot/
