https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7937
Bug ID: 7937
Summary: T_DOC_ATTACH_NO_EXT flaw in logic?
Product: Spamassassin
Version: unspecified
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Rules
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: Undefined
Hey there
We are seeing a high rate of detections against the T_DOC_ATTACH_NO_EXT test
which looks like so
T_DOC_ATTACH_NO_EXT __ATTACH_NAME_NO_EXT && (__PDF_ATTACH || __DOC_ATTACH_MT)
The logic here I don't think is quite right its saying:
If there is no attachment extension AND its a PDF or Document - then fire
However, the behavior we are seeing in production is:
There is an email with multiple attachments say 5 attachments
4 images (thanks email signatures :( ) with no extensions and 1 PDF file
The test is triggering because the image files don't have a extension.
I believe the logic should be:
(__ATTACH_NAME_NO_EXT && (__PDF_ATTACH || __DOC_ATTACH_MT))
To tie the missing extension to the detection of the PDF and Document clause.
I don't know the logic well enough to confirm if this is legal in the language
but.
--
You are receiving this mail because:
You are the assignee for the bug.
