Re: SA is inventing URIs
Alex <[email protected]> Fri, 26 Jun 2026 11:59:24 -0400
| Newsgroups | gmane.mail.spam.spamassassin.general |
|---|---|
| Message-ID | <CAB1R3sgDCM4pkq3sLBKj39H98FnpjTehA6NDookjYB7Vk74ULQ@mail.gmail.com> |
--00000000000006b30706552a32c2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi, For a URL like: https://substack.com/signup?r=3Dto8ex the Redirectors plugin from v402.pre generates: http://to8ex =E2=86=92 http://www.to8ex.com =E2=86=92 domain: to8ex.com even though no such URI exists anywhere in the message. URIDNSBL then performs lookups against to8ex.com, which can trigger URI reputation rules and false positives if that synthetic domain happens to exist. I've filed a Bugzilla report with a minimal reproducer, debug output, and the confirmation that disabling only the Redirectors plugin eliminates the behavior. https://bz.apache.org/SpamAssassin/show_bug.cgi?id=3D8401 Thanks, Alex On Thu, Jun 25, 2026 at 10:40=E2=80=AFAM John Hardin <[email protected]> w= rote: > On Wed, 24 Jun 2026, Alex wrote: > > > Hi, I hoped I could follow up on this. > > > > The issue is most certainly with the redirectors plugin from v402. > > # ls -l > /usr/share/perl5/vendor_perl/Mail/SpamAssassin/Plugin/Redirectors.pm > > -r--r--r-- 1 root root 43525 Jun 21 20:00 > > /usr/share/perl5/vendor_perl/Mail/SpamAssassin/Plugin/Redirectors.pm > > > > Jun 24 22:20:58.866 [1769470] dbg: uri: canonicalizing html uri: > > > https://substack.com/signup?utm_source=3Dsubstack&utm_medium=3Demail&utm_= content=3Dfooter&utm_campaign=3Dautofilled-footer&freeSignupEmail=3Dbulwark= @example.com&r=3Dto8ex > > Jun 24 22:20:58.866 [1769470] dbg: uri: cleaned uri: > > > https://substack.com/signup?utm_source=3Dsubstack&utm_medium=3Demail&utm_= content=3Dfooter&utm_campaign=3Dautofilled-footer&freeSignupEmail=3Dbulwark= @example.com&r=3Dto8ex > > Jun 24 22:20:58.948 [1769470] dbg: Redirectors: Found embedded uri to8e= x > in > > > https://substack.com/signup?utm_source=3Dsubstack&utm_medium=3Demail&utm_= content=3Dfooter&utm_campaign=3Dautofilled-footer&freeSignupEmail=3Dbulwark= @example.com&r=3Dto8ex > > Jun 24 22:20:58.948 [1769470] dbg: uri: canonicalizing parsed uri: > > http://to8ex > > Jun 24 22:20:58.948 [1769470] dbg: uri: cleaned uri: > http://www.to8ex.com > > Jun 24 22:20:58.948 [1769470] dbg: uri: added host: www.to8ex.com > domain: > > to8ex.com > > Jun 24 22:20:58.949 [1769470] dbg: uri: cleaned uri: http://to8ex > > > > Thanks, > > Alex > > Please open a big in bugzilla. > > -- > John Hardin KA7OHZ http://www.impsec.org/~jhardin/ > [email protected] pgpk -a [email protected] > key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 > ----------------------------------------------------------------------- > Crime will expand according to our willingness to put up with it. > -- Unknown > ----------------------------------------------------------------------- > 9 days until the 250th anniversary of the Declaration of Independence > --00000000000006b30706552a32c2 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"ltr">Hi,<div><br></div><div>For a URL like:<br><br><a href=3D"h= ttps://substack.com/signup?r=3Dto8ex">https://substack.com/signup?r=3Dto8ex= </a><br><br>the Redirectors plugin from v402.pre generates:<br><br><a href= =3D"http://to8ex">http://to8ex</a><br>=E2=86=92 <a href=3D"http://www.to8ex= .com">http://www.to8ex.com</a><br>=E2=86=92 domain: <a href=3D"http://to8ex= .com">to8ex.com</a><br><br>even though no such URI exists anywhere in the m= essage. URIDNSBL then performs lookups against <a href=3D"http://to8ex.com"= >to8ex.com</a>, which can trigger URI reputation rules and false positives = if that synthetic domain happens to exist.<br><br>I've filed a Bugzilla= report with a minimal reproducer, debug output, and the confirmation that = disabling only the Redirectors plugin eliminates the behavior.</div><div><d= iv><span style=3D"background-color:transparent"><a href=3D"https://bz.apach= e.org/SpamAssassin/show_bug.cgi?id=3D8401">https://bz.apache.org/SpamAssass= in/show_bug.cgi?id=3D8401</a></span></div><div><span style=3D"background-co= lor:transparent"><br></span></div><div><span style=3D"background-color:tran= sparent">Thanks,<br>Alex</span></div><div><span style=3D"background-color:t= ransparent"><br></span></div><div><span style=3D"background-color:transpare= nt"><br></span></div><div><br><br></div></div></div><br><div class=3D"gmail= _quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Thu,= Jun 25, 2026 at 10:40=E2=80=AFAM John Hardin <<a href=3D"mailto:jhardin= @impsec.org">[email protected]</a>> wrote:<br></div><blockquote class= =3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg= b(204,204,204);padding-left:1ex">On Wed, 24 Jun 2026, Alex wrote:<br> <br> > Hi, I hoped I could follow up on this.<br> ><br> > The issue is most certainly with the redirectors plugin from v402.<br> > # ls -l /usr/share/perl5/vendor_perl/Mail/SpamAssassin/Plugin/Redirect= ors.pm<br> > -r--r--r-- 1 root root 43525 Jun 21 20:00<br> > /usr/share/perl5/vendor_perl/Mail/SpamAssassin/Plugin/Redirectors.pm<b= r> ><br> > Jun 24 22:20:58.866 [1769470] dbg: uri: canonicalizing html uri:<br> > <a href=3D"https://substack.com/signup?utm_source=3Dsubstack&utm_m= edium=3Demail&utm_content=3Dfooter&utm_campaign=3Dautofilled-footer= &[email protected]&r=3Dto8ex" rel=3D"noreferrer= " target=3D"_blank">https://substack.com/signup?utm_source=3Dsubstack&u= tm_medium=3Demail&utm_content=3Dfooter&utm_campaign=3Dautofilled-fo= oter&[email protected]&r=3Dto8ex</a><br> > Jun 24 22:20:58.866 [1769470] dbg: uri: cleaned uri:<br> > <a href=3D"https://substack.com/signup?utm_source=3Dsubstack&utm_m= edium=3Demail&utm_content=3Dfooter&utm_campaign=3Dautofilled-footer= &[email protected]&r=3Dto8ex" rel=3D"noreferrer= " target=3D"_blank">https://substack.com/signup?utm_source=3Dsubstack&u= tm_medium=3Demail&utm_content=3Dfooter&utm_campaign=3Dautofilled-fo= oter&[email protected]&r=3Dto8ex</a><br> > Jun 24 22:20:58.948 [1769470] dbg: Redirectors: Found embedded uri to8= ex in<br> > <a href=3D"https://substack.com/signup?utm_source=3Dsubstack&utm_m= edium=3Demail&utm_content=3Dfooter&utm_campaign=3Dautofilled-footer= &[email protected]&r=3Dto8ex" rel=3D"noreferrer= " target=3D"_blank">https://substack.com/signup?utm_source=3Dsubstack&u= tm_medium=3Demail&utm_content=3Dfooter&utm_campaign=3Dautofilled-fo= oter&[email protected]&r=3Dto8ex</a><br> > Jun 24 22:20:58.948 [1769470] dbg: uri: canonicalizing parsed uri:<br> > <a href=3D"http://to8ex" rel=3D"noreferrer" target=3D"_blank">http://t= o8ex</a><br> > Jun 24 22:20:58.948 [1769470] dbg: uri: cleaned uri: <a href=3D"http:/= /www.to8ex.com" rel=3D"noreferrer" target=3D"_blank">http://www.to8ex.com</= a><br> > Jun 24 22:20:58.948 [1769470] dbg: uri: added host: <a href=3D"http://= www.to8ex.com" rel=3D"noreferrer" target=3D"_blank">www.to8ex.com</a> domai= n:<br> > <a href=3D"http://to8ex.com" rel=3D"noreferrer" target=3D"_blank">to8e= x.com</a><br> > Jun 24 22:20:58.949 [1769470] dbg: uri: cleaned uri: <a href=3D"http:/= /to8ex" rel=3D"noreferrer" target=3D"_blank">http://to8ex</a><br> ><br> > Thanks,<br> > Alex<br> <br> Please open a big in bugzilla.<br> <br> -- <br> =C2=A0 John Hardin KA7OHZ=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 <a href=3D"http://www.impsec.org/~jhardin/" rel=3D"nor= eferrer" target=3D"_blank">http://www.impsec.org/~jhardin/</a><br> =C2=A0 <a href=3D"mailto:[email protected]" target=3D"_blank">jhardin@imps= ec.org</a>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0pgpk -a <a href=3D"mailto:[email protected]" ta= rget=3D"_blank">[email protected]</a><br> =C2=A0 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C=C2=A0 AF76 D822 E6E6 B87= 3 2E79<br> -----------------------------------------------------------------------<br> =C2=A0 =C2=A0Crime will expand according to our willingness to put up with = it.<br> =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 -- Unknown<b= r> -----------------------------------------------------------------------<br> =C2=A0 9 days until the 250th anniversary of the Declaration of Independenc= e<br> </blockquote></div> --00000000000006b30706552a32c2--