[Mimedefang] Filtering new Mirosoft virus email ...

Joseph Brennan brennan at columbia.edu
Fri Sep 26 16:15:01 EDT 2003


>>   if ($Subject eq "Fwd: Current Net Security Patch") {
>
> How can I get at the header name, instead of its value? I want to check
> for "SUBJECT:" (all upper case).



Since case is not supposed to matter in the label, many tools ignore
it and don't give you access to it.

You can open the headers as below.  This is mildly expensive.  I don't
know about doing it solely to check for 'SUBJECT:'.  But if you see
the need to check any headers, then it's no big deal to check one more
while you're at it.  But here's just the one test:

In filter_begin()...

   if (open(IN,"<./HEADERS")) {
        my($capitalsubject);
        while(<IN>) {
            chomp;
            if (/^SUBJECT:/)    {  $capitalsubject = 1; }
        }
        close(IN);

        #be sure to do the close(IN)
        #then test the data, below

        if ($capitalsubject) {
            #take some action
        }

   }


Or maybe even

          if (/^SUBJECT: (.*)/)   {  $capitalsubject = $1; }

and then below you can test what the SUBJECT: line contained.



Joe Brennan








More information about the MIMEDefang mailing list