body_checks regex explained in detail Re: Inline image spams

On 12/24, Anthony Campbell wrote:
> I didn't quite understand the above rule, but I've found that this
> header line: 

What didn't you understand?  I've updated
http://www.chaosreigns.com/spam/#image to include all the following detail.

It's a regex that looks for "src equals cid:" (with an equals sign and
a quote in there).

The regex is:
/\bsrc\s*=(?:3D)?\s*["']?cid:/ REJECT Your email was rejected because you embedded an attached image in the body. 

/        = beginning of the regex
\b       = "match a word boundary" - the beginning or end of a word, in this
            case, the spot between whitespace and "src"
src      = part of the image tag
\s*      = any amount of whitespace (including none)
=        = the equals sign in the img tag
(?:3D)?  = accounts for quoted printable encoding which turns a "=" into "=3D"
\s*      = any amount of whitespace (including none)
["']?    = single or double quote around the url in the img tag, "?" means
           it's okay if it's not there
cid:     = the part of an img tag url that replaces http:  and means it's
           an attached file
/        = end of the regex

You put that regex line in a file called something like
/etc/postfix/body_checks, and then add this line to your postfix main.cf:
body_checks = pcre:/etc/postfix/body_checks

Anything you still don't understand?  Anybody see any detail I missed or
got wrong?

> 	Content-Type: multipart/related;
> 
> is present in all such emails and in no others, including the legitimate
> attachments I receive. Putting this in procmail has worked 100% so far.

My concern about this is that I would expect most email clients to go ahead
and display the image spam just fine if they break standards and skip that
header.  So you'll filter successfully short term but long term you're just
encouraging them to violate standards to get around your filter.

-- 
"You will need: a big heavy rock, something with a bit of a swing to it...
perhaps Mars" - http://ned.ucam.org/~sdh31/misc/destroy.html
http://www.ChaosReigns.com

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV