On Fri, Apr 17, 2009 at 09:07:23AM -0400, Kevin A. McGrail wrote: > On Fri, Apr 17, 2009 at 11:16:14AM +0200, Jan Pieter Cornet wrote: > > On Thu, Apr 16, 2009 at 10:37:33PM -0400, Kevin A. McGrail wrote: > > > Richard, > > > > > > I've been looking at this and the code seems to work but I wonder if you > > > can't achieve the same result with just a regexp: > > > > > > if ($Subject =~ /=\?(koi8-r|Windows-1251)\?/i) { > > > } > > > > No. At least, not if you actually care about legitimate email. > > Jan, > > In spot checking my uncaught SPAM, I couldn't find a case that this > didn't work for. Can you check your headers manually and see if you > can find an example of Russian SPAM that doesn't use this format? > > From my experience, you'll need to make sure you view text source as > most MUAs will decode the header at least somewhat.
Err. Other way around. I said it generates false positives, not false negatives. But in hindsight, it is somewhat unlikely that a mailer would mime-encode the subject header with =?windows-1251?Q?... and then not include any non-ascii characters. I did find (on this list even) an example of a mail saying "Content-Type: text/plain; charset=Windows-1251", that was still legit and did not contain non-ascii content (July 31, 2007 from Dmitry). -- Jan-Pieter Cornet <joh...@xs4all.nl> !! Disclamer: The addressee of this email is not the intended recipient. !! !! This is only a test of the echelon and data retention systems. Please !! !! archive this message indefinitely to allow verification of the logs. !! _______________________________________________ NOTE: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID. You may ignore it. Visit http://www.mimedefang.org and http://www.roaringpenguin.com MIMEDefang mailing list MIMEDefang@lists.roaringpenguin.com http://lists.roaringpenguin.com/mailman/listinfo/mimedefang