Re: Checking for email attachment name for containing Javscript code that could get potentially executed when displayed on a webpage.

[Ned Slider]

On 08/03/13 14:05, Sharma, Ashish wrote:

Can you pastebin an example?  Not sure what you mean with the attachment
*name* contains JS code.

Here is the requested sample

http://pastebin.com/DN7PRnH4

The attachment name contains the javascript code at the bottom of the pasted 
file.

thanks
Ashish

You could try this (untested):

mimeheader      L_CT_DOCWRITE           Content-Type =~ /document\.write/
score           L_CT_DOCWRITE           1
describe                L_CT_DOCWRITE           Content-type contains 
document.write

Score as you see fit.

-----Original Message-----
From: Axb [mailto:axb.li...@gmail.com]
Sent: Wednesday, March 06, 2013 3:59 PM
To: users@spamassassin.apache.org
Subject: Re: Checking for email attachment name for containing Javscript code 
that could get potentially executed when displayed on a webpage.

On 03/06/2013 11:20 AM, Sharma, Ashish wrote:

All,

I have a mail receiving server that parses incoming emails for email attachment 
and the files are listed on a web page for users to see.

Here I need to check for email attachment name for containing Javscript code 
that could get potentially executed when displayed on a webpage.

Is there a way in Spamassassin conf that can help me in testing for the above 
mentioned scenario?

Can you pastebin an example?  Not sure what you mean with the attachment
*name* contains JS code.