Theo Van Dinter writes: >On Mon, Nov 27, 2006 at 03:04:54PM +0000, Tony Finch wrote: >> I'm thinking of trying matches against (parts of) binary attachments. The >> only way I can think of doing this is using full rules to match fragments >> of base64. > >A plugin will do it much better. For instance, you'll be able to limit your >search against binary attachments. :)
well, that could argue that we should come up with a MIMEFull rule type plugin, similar to the MIMEHeader plugin... >> Also, I believe that a lot of legitimate messages (from Microsoft MUAs) >> contain NULs, typically at the end of attachments. Therefore my servers >> strip NULs rather than rejecting them. Insert usual rant about the quality >> of standards conformance in legitimage email :-( > >At the end of attachments in terms of the raw or encoded version? So far: > > 1.138 1.3665 0.0016 0.999 0.87 1.00 NULL_IN_BODY > >which works for me. I don't think they're common in any meaningful way. nice results there! --j.
