John Hardin wrote:
>> mimeheader DSL4DIG_PNG Content-Type =~ /name\=\"DSL[0-9]{4}\.png\"/
>
> It seems a wave of image spam is going out. Would it be reasonable to
> push this rule (with suitable modifications for length, etc.) and/or the
> ImageInfo version out as a base SA update so that the most people can
> benefit?
My dialog with aixenv on irc://irc.freenode.net/#spamassassin (and
other parts of this thread) yielded a slightly more flexible regex,
matched with the fact that the image always has the same dimensions:
mimeheader __DSCL4_PNG Content-Type =~ /name\=\"DS[CL]\d{4,5}\.png\"/
body __PNG_240_400 eval:image_size_exact('png',240,400)
meta DSCL4DIG_PNG __DSCL4_PNG && __PNG_240_400
describe DSCL4DIG_PNG Supposed digital camera photo is a PNG
Probably the mimeheader check alone is enough.
--
Adam Katz
khopesh on irc://irc.freenode.net/#spamassassin
http://khopesh.com/Anti-spam
