On 12/31/2009 7:57 PM, Mike Cardwell wrote:
I just received some HAM with a surprisingly high score. The following
rule triggered:
* 3.2 FH_DATE_PAST_20XX The date is grossly in the future.
Yet the date header looks fine to me:
Date: Fri, 1 Jan 2010 00:46:45 GMT
In /usr/share/spamassassin/72_active.cf I find:
header FH_DATE_PAST_20XX Date =~ /20[1-9][0-9]/ [if-unset: 2006]
Doesn't look particularly sane to me... I have given that rule a score
of 0 in my local.cf for now.
My question is: Instead of using a hard-coded acceptable list of years,
the rule isn't written more in the fashion of DATE_IN_PAST_96_XX which
calculates the offset?
header Date: is 96 hours or more before Received: date
DATE_IN_PAST_96_XX 2.952 2.320 1.800 1.690
eval:check_for_shifted_date('undef', '-96')
header Date: is 96 hours or more after Received: date
DATE_IN_FUTURE_96_XX 3.899 3.899 2.598 1.439
Then you could replace FH_DATE_PAST_20XX with a set of rules that check
the date against the current date and score accordingly. I'm guessing
that intervals of 3 days, 7 days and 30 days before/after would provide
a suitable set.
