On 08/09/11 16:23, John Hardin wrote:
On Thu, 8 Sep 2011, Edward Prendergast wrote:
I'm seeing CTYPE_NULL triggering for certain messages from gmail.
If I compare a message that doesn't trigger CTYPE_NULL:
Content-Type: multipart/related;
With one that does:
Content-Type: multipart/related;
CTYPE_NULL certainly shouldn't fire on either of those. Are they
really identical, or is that a cut-and-paste error? Are those complete
copies of ALL of the Content-Type headers in the message?
Would it be possible to post the full FP message to a pastebin? Given
what we're looking at, anonymization of email addresses, host names
and body content shouldn't affect the analysis, just make sure you
don't alter any of the MIME-related headers.
Sorry, that WAS a typo, I meant to show a more standard content-type
from a message not triggering CTYPE_NULL:
Content-Type: multipart/mixed;
It's quite heavily redacted, but haven't made any changes to the MIME
header stuff.
https://gist.github.com/1203746
Thanks
************
The information in this email is confidential and may be legally privileged.
It is intended solely for the addressee. Access to this email by anyone else
is unauthorised. If you are not the intended recipient, any action taken or
omitted to be taken in reliance on it, any form of reproduction,
dissemination, copying, disclosure, modification, distribution and/or
publication of this E-mail message is strictly prohibited and may be
unlawful. If you have received this E-mail message in error, please notify
us immediately. Please also destroy and delete the message from your
computer.
************
