[Mimedefang] Content scanning..

[Jim McCullars]

On Tue, 18 Feb 2003, Richardson  M. wrote:

> What i would like to be able to do:
>
> scan all email for a string(s) in the subject line. (or any header string,
> but less usefull)

   Scanning for a string in the subject line is quite easy.  Just do
something like this in filter_begin:

	if ($subject = "string-to-match") {
          # action to take if match
        }

Or what you probably want to do is a pattern match instead of matching the
subject exactly:

	if ($subject =~ /pattern-to-match/) {
	  # action to take
	}

Trying to match any header is a bit more tricky, because unless
mimedefang.pl sets a variable, you have to read the HEADERS file yourself.
Suppose you want to look for a X-ORIGINATING-IP: header.  Do something
like this (also in filter_begin):

	open (IN, "./HEADERS") || die "Error opening headers file!";
	while (<IN>) {
	  chop();
	  if (/^X-ORIGINATING-IP:/) {  # this the header we want?
	    if (/pattern-to-look-for-in-header/) { # yes, check value
	      # do something if it matches
	    }
	  }
	}
	close (IN);

> scan all emails for a string(s) in the message body.

	open (IN, "./INPUTMSG") || die "Error opening input message";
	while (<IN>) {
	  chop();
	  if (/pattern-to-look-for-in-each-line/) {
	    # do something
	  }
	}
	close(IN);

> And more efficiently:
> scan all email for a string(s) in the subject line sent to a specific e-mail
> adress(es).
> scan all emails for a string(s) in the message body sent to a specific
> adress(es).

   Similar to the above, just wrap the tests around somethine like this:

	foreach $recip (@Recipients) {
	  if ($recip =~ /username-pattern-match/) {
	    # do stuff above
	  }
	}


but be careful!  Remember that a message can have multiple recipients, and
unless you do stream-by-recipient, you can wind up scanning the same email
multiple times (bad), and applying recipient A's rules to recipient B
(worse).

   Above code snippets are untested, and may contain typos or other
errors.  HTH...

Jim