[Mimedefang] filtering messages based on mime boundary name?

Matt Selsky selsky at columbia.edu
Fri Aug 22 15:07:00 EDT 2003


We're receiving quite a few messages that look like Sobig.F, but don't
actually contain an attachment.

The mime boundary seems to be consistent and this regex should 
catch it:

/boundary=\"?_NextPart_000_........\"?$/

First, does this seem like a reasonable heuristic for blocking this 
Sobig.F variant?

Second, would it be feasible to filter() to get passed the boundary
information as well as the 4 parameters it currently gets?

I suppose I could access this info via the following, but it might be
convenient to make it more available.

$entity->head()->multipart_boundary();



More information about the MIMEDefang mailing list