On Fri, 16 Nov 2018 08:48:56 -0800 Ian Zimmerman wrote:
> 1. Am I correct in assuming that SA decodes base64 MIME parts so it > does act on these links? Reading the -D output surely indicates so. I think you've already answered that. > 2. I remember some discussion here about following shortener links > like bitly. What is the resolution of that? Does SA currently (as > of 3.4.2) follow such links, to see (for example) that the link in my > spample led to Facebook? See https://github.com/smfreegard/DecodeShortURLs but Facebook isn't going to be listed anywhere. There is a test for bitly links that have already been blocked. > 3. The documentation for the HashBL plugin shows how to set it up to > check addresses from headers. Is there a way to also check addresses > from mailto links in the body? It's already supposed to do that. It doesn't actually say it only checks headers. If you are thinking of: header HASHBL_EMAIL eval:check_hashbl_emails('ebl.msbl.org') AFAIK that 'header' is just a matter of syntax and taxonomy and the only practical difference it makes is that HASHBL_EMAIL's score counts towards the 3 header points needed for auto-learning.
