Does SA already have a rule for headers like this:
To: gward <[EMAIL PROTECTED]>
? If not, I think it should -- this seems a fairly popular tactic.
The one I got this morning looked like this:
To: "Gward" <[EMAIL PROTECTED]>
...so any such rule should be case-insensitive and handle RFC 822
address quoting, of course.
Here's a quick and dirty attempt:
header TO_REALNAME_EQ_LOCALPART To =~ /\"?(\w+)\"?\s+<\1\@[^<>]+>/i
describe TO_REALNAME_EQ_LOCALPART Real name in "To:" equals local part
score TO_REALNAME_EQ_LOCALPART 2.5
Comments?
Greg
--
Greg Ward - software developer [EMAIL PROTECTED]
MEMS Exchange http://www.mems-exchange.org
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
