While RFC2045 says that the boundary parameter of the header Content-Type: multipart/alternative; can be quoted or not, spamassassin seems to treat them differently, in particular it seem not to consider an unquoted boundary parameter as MIME.
rfc2045: >Note that the value of a quoted string parameter does not include the > quotes. That is, the quotation marks in a quoted-string are not a > part of the value of the parameter, I stumbled over the problem, while testing SA for a week now, when I tried to write a rule looking for a raw, base64-encoded string. So, most of the relevant spams coming in got a hit with body TOM_VIRULENT1 /EFNWM\/ZXM9uJdeyJdfiJRfA7dRAPjW8BAACLRfBqA1o7wolV9H0DiUX0i030uD09PT2Nffxm/ describe TOM_VIRULENT1 Contains a base64encoded virulent string EFNWM... (body) score TOM_VIRULENT1 6.00 apparently having a Content-Type: multipart/alternative; with an _unquoted_ boundary definition, such as: >Content-Type: multipart/alternative; > boundary=Boundary_(ID_NkhZmutkkJoAa25xy1O6QA) The spam today which came with a _quoted_ boundary definition: >Content-type: multipart/alternative; > boundary="Boundary_(ID_NkhZmutkkJoAa25xy1O6QA)" and did not get a hit at all. I finally realized that the rule 'body' is not supposed to look into the not-decoded base64 string, and tried 'rawbody' and 'full', but they do not get a hit in any case. I also find the explanation of 'full' confusing: http://www.spamassassin.org/doc/Mail_SpamAssassin_Conf.html >The 'full body' of a message is the un-decoded text, including all >parts (including images or other attachments). ok, so I would expect a hit with my base64 line. But what does this mean??? : >SpamAssassin no longer tests full tests against decoded text; >use rawbody for that. using: X-Spam-Checker-Version: SpamAssassin 2.20 (devel $Id: SpamAssassin.pm,v 1.77 200 2/04/06 19:28:30 hughescr Exp $) -- Viele Grüße Tom _______________________________________________________________ Don't miss the 2002 Sprint PCS Application Developer's Conference August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
