[Mimedefang] Re: slightly OT : spam html images only

[Jeremy Mates]

* Karel.DeBruyne at ua.ac.be <Karel.DeBruyne at ua.ac.be>
> recently, a lot of spam is a few lines of text and an image (or a few
> images). SpamAssassin 2.53 is rewarding this with a score of 1.9 To
> me, this seems too little! Is it wise to modify the default scores of
> SpamAssassin ?

Another option is to do a bit of MIME parsing, and look for messages
that have only a bit of text and an image.  The following fragment is
something I am experimenting with to catch spam that have an empty text
part, plus some HTML crud.

sub filter_multipart ($$$$) {
  my ($entity, $fname, $ext, $type) = @_;

  if ($entity->parts > 1) {
    my %counts;
    for my $part ($entity->parts) {
      $counts{$part->mime_type} += length $part->bodyhandle->as_string;
    }
    if (  keys %counts == 2
      and exists $counts{'text/html'}
      and exists $counts{'text/plain'}
      and $counts{'text/plain'} == 0) {
#      action_quarantine_entire_message("Message quarantined because of empty te
xt parts");
      md_log('emptytext');
    }
  }

}