[Mimedefang] filtering messages based on mime boundary name?
Matt Selsky
selsky at columbia.edu
Fri Aug 22 15:07:00 EDT 2003
We're receiving quite a few messages that look like Sobig.F, but don't
actually contain an attachment.
The mime boundary seems to be consistent and this regex should
catch it:
/boundary=\"?_NextPart_000_........\"?$/
First, does this seem like a reasonable heuristic for blocking this
Sobig.F variant?
Second, would it be feasible to filter() to get passed the boundary
information as well as the 4 parameters it currently gets?
I suppose I could access this info via the following, but it might be
convenient to make it more available.
$entity->head()->multipart_boundary();
More information about the MIMEDefang
mailing list