On 9/28/2009 12:02 PM, Brian Evans - Postfix List wrote:
Noel Jones wrote:
On 9/28/2009 11:17 AM, Brian Evans - Postfix List wrote:
Noel Jones wrote:
On 9/28/2009 10:35 AM, Brian Evans - Postfix List wrote:
How would you detect a quoted-printable line feed in header checks?
I get lots of spam that includes several of these and would like to
reject them early.
If there is a good reason not to do this, please note such.
So something like: header_checks=pcre:/path/to/file
/^Subject: .*=0A/ REJECT Bad Subject format
would work?
Yes, that should do the trick.
This is RFC breakage behavior I am trying to stop in the Subject line.
http://tools.ietf.org/html/rfc5322#section-2.2
The section says you can't use the LF character. Nothing in that
section says you can't use "=0A" in your Subject.
OK.. then how about this refined pcre:
/^Subject: =\?.*\?Q\?.*(=0A(\s)?)*\?=$/ REJECT Bad Subject format
With the inclusion of the quoted-printable header definition, I think
the chances of false positives would be very low.
But why do you think a QP line feed will never occur in a
legit mail? (complex expression not reviewed)
-- Noel Jones
