svn commit: r1933471 - spamassassin/trunk/rulesrc/sandbox/jhardin

Author: jhardin
Date: Wed Apr 29 03:46:39 2026
New Revision: 1933471

Log:
Obfuscated HTML attachment tweaks

Modified:
   spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf

Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf	Wed Apr 29 02:48:42 2026	(r1933470)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf	Wed Apr 29 03:46:39 2026	(r1933471)
@@ -73,8 +73,10 @@ ifplugin Mail::SpamAssassin::Plugin::MIM
   meta         HTML_ATTACH         __HTML_ATTACH_01 || __HTML_ATTACH_02
   describe     HTML_ATTACH         HTML attachment to bypass scanning?
 
-  mimeheader   OBFU_HTML_ATTACH    Content-Type =~ m,\bapplication/octet-stream\b.+\.[a-z]?html?\b,i
+  mimeheader   __OBFU_HTML_ATTACH  Content-Type =~ m,\bapplication/octet-stream\b.+\.[a-z]?html?\b,i
+  meta         OBFU_HTML_ATTACH    __OBFU_HTML_ATTACH && !__DOS_LINK 
   describe     OBFU_HTML_ATTACH    HTML attachment with non-text MIME type
+  tflags       OBFU_HTML_ATTACH    publish
 
   mimeheader   OBFU_TEXT_ATTACH    Content-Type =~ m,\bapplication/octet-stream\b.+\.txt\b,i
   describe     OBFU_TEXT_ATTACH    Text attachment with non-text MIME type
@@ -97,7 +99,7 @@ ifplugin Mail::SpamAssassin::Plugin::MIM
   describe     OBFU_GIF_ATTACH     GIF attachment with generic MIME type
   #score        OBFU_GIF_ATTACH     1.50
 
-  meta         OBFU_ATTACH_MISSP   __FROM_RUNON && (OBFU_HTML_ATTACH || OBFU_TEXT_ATTACH || OBFU_DOC_ATTACH || OBFU_PDF_ATTACH || OBFU_JPG_ATTACH || OBFU_GIF_ATTACH)
+  meta         OBFU_ATTACH_MISSP   __FROM_RUNON && (__OBFU_HTML_ATTACH || OBFU_TEXT_ATTACH || OBFU_DOC_ATTACH || OBFU_PDF_ATTACH || OBFU_JPG_ATTACH || OBFU_GIF_ATTACH)
   describe     OBFU_ATTACH_MISSP   Obfuscated attachment type and misspaced From
 
 #  mimeheader   ECMSNGR_MH          X-ecm-part-format =~ /./
@@ -4460,4 +4462,7 @@ describe   PMP_SPAM                    P
 score      PMP_SPAM                    2.500	# limit
 tflags     PMP_SPAM                    publish
 
+ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
+  mimeheader   __OBFU_HTML_ATTACH_RECHNUNG    Content-Type =~ m,\bapplication/octet-stream\b.+rechnung.*\.[a-z]?html?\b,i
+endif