On Thu, 31 Mar 2016, RW wrote:

On Thu, 31 Mar 2016 08:12:10 -0700 (PDT)
John Hardin wrote:

I don't follow what you're saying, can you provide an example?

They have something like:

 Content-Type: text; charset="utf-8"

rather than

 Content-Type: text/plain; charset="utf-8"

It's probably a rare mistake, but I was thinking of a rule like:


header       __MISSING_SUBTYPE_1  Content-Type =~  /^\w+[;\s]/
mimeheader   __MISSING_SUBTYPE_2  Content-Type =~  /^\w+[;\s]/

meta         MISSING_SUBTYPE      __MISSING_SUBTYPE_1 || __MISSING_SUBTYPE_2

Seems reasonable, but if it *is* a rare mistake there may not be enough in the masscheck corpus to get it scored and published.

--
 John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
 jhar...@impsec.org    FALaholic #11174     pgpk -a jhar...@impsec.org
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
  Pork (n): (political) The manifestation of the principle that it is
  a felony to bribe a legislator, unless you are also a legislator.
-----------------------------------------------------------------------
 Tomorrow: April Fools' day

Reply via email to