Hi, David Funk wrote: >>> /^(Content-(Type|Disposition)\:|[[:space:]]+).*(file)?name="?.*\.doc"?;?$/ >>> >>> REJECT >>> >>> I believe something like this would work in spamassassin: >>> >>> mimeheader DOC_ATTACHED Content-Type =~ /="[^"]+\.(?:docx?|rtf)"/i >>> score DOC_ATTACHED 12.5 >> >> This may catch some documents but MS products key almost entirely on the >> file name extension. >> >> So the content type header may be "application/octet-stream" and totally >> missing a 'name=' component but if there's also a Content-Disposition >> header that has a 'filename=' component it will trigger file opening >> behaivor.
Are you suggesting another regex for postfix is necessary? If so, please provide an example. Robert Schetterer wrote: > just found > > https://github.com/sbidy/MacroMilter This looks to be helpful for users who don't already have clamav, correct? It otherwise looks to duplicate only a portion of clamav's capability. Thanks, Alex
