Re: Using Amavis to reject/quarantine email with MIME-encoded Subject Fields

Benedict,

Am 01.09.21 um 00:57 schrieb Benedict White:
> -----Original Message-----
> From: amavis-users [mailto:[email protected]] On Behalf Of Benny Pedersen
> Sent: 31 August 2021 20:44
> To: [email protected]
> Subject: Re: Using Amavis to reject/quarantine email with MIME-encoded Subject Fields
>
> On 2021-08-31 18:58, Benedict White wrote:
>
>> header  MyRuleNumberOne          Subject =~ /RgNC10LTQ/i
>>
>> score	MyRuleNumberOne		5.0
>>
>> The rules looks for something containing " RgNC10LTQ" and the i after
>> the / means case insensitive. You can remove that if this is the
>> precise spelling you are looking for.
> https://spamassassin.apache.org/full/3.1.x/doc/Mail_SpamAssassin_Plugin_WhiteListSubject.html
>
> it supports blacklist :=)
>
> it must be mime decoded content in the blacklist_subject ....
>
>
> ###
> My understanding is that the subject appears in the header and isn't encoded. The reason it appears as this gobbledegook is an error in the spam generation, as such, the error can be exploited with a simple rule as I wrote.

this holds true only for ASCII-based languages, but not e.g. for German
where you would have Umlauts like "Passwort zurücksetzen" (reset
password) in Subject:-Headers which MUST (RFC) be MIME encoded in order
not to break 7-bit servers while they are in transit.

p@rick

-- 
[*] sys4 AG

https://sys4.de, +49 (89) 30 90 46 64
Schleißheimer Straße 26/MG,80333 München

Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief
Aufsichtsratsvorsitzender: Florian Kirstein