The BAD_HEADER defaging copies errant headers. An email which has e.g. a
broken 'Subject' line is defanged if, $defang_bad_header is true. The
defanging routine, however just copies the original headers to the newly
created mail - the new mail will have a broken header again.
This does not solve any problem the problem :-(. Email with poorly
standard compliant email is known to produce problems in MDA or MUAs.
e.g. cyrus-imapd
- refuses to deliver messages with '\r' in the original headers
- replaces all non-7bit characters in message headers with 'X'
MUA
- searching/indexing breaks
To reproduce: Send an email with non-7bit characters in the header
through amavisd-new.
Proposed fix: make amavisd-new smart enough to fix errant headers
unfortunately i have no clue how to fix that :-/... comments anybody?
Anthother proposed feature:
---------------------------------
defang_bad_header is only called if the email does not fall into any
other class i.e. the mail is not: "CLEAN", "VIRUS", "BANNED", ... how
about making $defang_bad_header orthogonal to all other classes.
Usually you do not want to defang spam. But still you want to defang
every mail with bad_headers to protect mail clients and ensure the
validity of index files, filter rules,...
I thing you could implement that fairly quickly (it's untested, though):
change
....
} elsif (@bad_headers) {
$explanation = 'WARNING: bad headers '.join(' ',@bad_headers)
if c('defang_bad_header') || $defang_all;
} else { $explanation = '(clean)' if $defang_all }
if (defined $explanation) { # malware
...
to
...
} elsif ([EMAIL PROTECTED]) { $explanation = '(clean)' if
$defang_all }
if (!defined($explanation) and @bad_headers) {
$explanation = 'WARNING: bad headers '.join(' ',@bad_headers)
if c('defang_bad_header') || $defang_all;
}
if (defined $explanation) { # malware
...
Regards,
Matt
Configuration:
sendmail-dual (8.13)
cyrus-imapd
amavisd-new 2.3.3
-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=lnk&kid0944&bid$1720&dat1642
_______________________________________________
AMaViS-user mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/
