[Mimedefang] Multipart non-rfc822 .eml rule

[Brent J. Nordquist]

I have MD 2.27.  As a "control" test, I sent an old multipart message that
had a message/rfc822 .eml file, and as expected it passed through MD just
fine.  Here's what it looked like:

[...]
X-Mailer: Microsoft Outlook Express 5.00.2014.211
X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2014.211
Content-Type: multipart/mixed;
	boundary="----=_NextPart_000_008A_01BF9EE0.5927B2A0"

This is a multi-part message in MIME format.

------=_NextPart_000_008A_01BF9EE0.5927B2A0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

[...]

------=_NextPart_000_008A_01BF9EE0.5927B2A0
Content-Type: message/rfc822;
	name="test.eml"
Content-Transfer-Encoding: 7bit
Content-Disposition: attachment;
	filename="test.eml"

[...]

Then I altered the message in only one way (I changed "message/rfc822" to 
"application/msword") so now it's still multipart, but doesn't have the 
rfc822 MIME type any more.  I was expecting to get this message from 
inside filter_multipart:

    if (re_match($entity, '\.eml') and ($type ne "message/rfc822")) {
        md_log('non_rfc822',$fname);
        return action_drop_with_warning("A non-message/rfc822 attachment named $fname was removed from this document as it\nconstituted a security hazard.  If you require this document, please contact\nthe sender and arrange an alternate means of receiving it.\n");
    }

Instead I got this one from inside filter, and I'm just curious why.  The
message is still multipart.

    if (re_match($entity, '\.eml')) {
        md_log('non_multipart');
        return action_quarantine($entity, "A non-multipart attachment named $fname was removed from this document as it\nconstituted a security hazard.  If you require this document, please contact\nthe sender and arrange an alternate means of receiving it.\n");
    }

-- 
Brent J. Nordquist <b-nordquist at bethel.edu> N0BJN
Other contact information: http://kepler.acns.bethel.edu/~bjn/contact.html