On Wed, Jul 24, 2002 at 10:26:00AM -0400, Theo Van Dinter wrote:
> I posted my AUDIO_ATTACH patch a while ago. :) I've reattached the patch.
I hate doing this, but I was just noticing a bug or two in that patch ...
I've attached a new one. :)
--
Randomly Generated Tagline:
Circular Definition: see Definition, Circular.
diff -urN lib.orig/Mail/SpamAssassin/EvalTests.pm lib/Mail/SpamAssassin/EvalTests.pm
--- lib.orig/Mail/SpamAssassin/EvalTests.pm Tue Jun 18 08:29:07 2002
+++ lib/Mail/SpamAssassin/EvalTests.pm Wed Jul 24 10:35:40 2002
@@ -1481,4 +1481,24 @@
sub check_for_missing_headers { return 0; } # obsolete test
+# search for likely MS worms
+sub check_for_audio_executables {
+ my ($self, $fulltext) = @_;
+
+ my $content_type = $self->{msg}->get_header('Content-Type');
+ $content_type = '' unless defined $content_type;
+ $content_type =~ /\bboundary\s*=\s*["']?(.*?)["']?(?:;|$)/i;
+
+ # No message sections to check
+ return 0 unless ( defined $1 );
+
+ my $boundary = "\Q$1\E";
+
+ while ( $$fulltext =~ /^--$boundary\n((?:[^\n]+\n)+)/mg ) {
+ return 1 if ( $1 =~
+m@^Content-Type:\s+audio/x-(?:wav|midi)\b.{0,100}\bname=.{0,100}\.(?:exe|pif|scr|bat|com)\b@msi
+ );
+ }
+
+ 0;
+}
+
1;
