[Mimedefang] Rejecting Cyrillic

Jan Pieter Cornet johnpc at xs4all.nl
Fri Apr 17 11:17:49 EDT 2009


On Fri, Apr 17, 2009 at 09:07:23AM -0400, Kevin A. McGrail wrote:
> On Fri, Apr 17, 2009 at 11:16:14AM +0200, Jan Pieter Cornet wrote:
> > On Thu, Apr 16, 2009 at 10:37:33PM -0400, Kevin A. McGrail wrote:
> > > Richard,
> > > 
> > > I've been looking at this and the code seems to work but I wonder if you 
> > > can't achieve the same result with just a regexp:
> > > 
> > > if ($Subject =~ /=\?(koi8-r|Windows-1251)\?/i) {
> > > }
> > 
> > No. At least, not if you actually care about legitimate email.
> 
> Jan,
> 
> In spot checking my uncaught SPAM, I couldn't find a case that this
> didn't work for. Can you check your headers manually and see if you
> can find an example of Russian SPAM that doesn't use this format?
> 
> From my experience, you'll need to make sure you view text source as
> most MUAs will decode the header at least somewhat.

Err. Other way around. I said it generates false positives, not false
negatives.

But in hindsight, it is somewhat unlikely that a mailer would
mime-encode the subject header with =?windows-1251?Q?... and then not
include any non-ascii characters. I did find (on this list even) an
example of a mail saying "Content-Type: text/plain; charset=Windows-1251",
that was still legit and did not contain non-ascii content (July 31, 2007
from Dmitry).

-- 
Jan-Pieter Cornet <johnpc at xs4all.nl>
!! Disclamer: The addressee of this email is not the intended recipient. !!
!! This is only a test of the echelon and data retention systems. Please !!
!! archive this message indefinitely to allow verification of the logs.  !!



More information about the MIMEDefang mailing list