On Thu, 2019-11-28 at 11:56 -0500, Joe Acquisto-j4 wrote:
> I want to be able to reprocess a particular email, marked as SPAM,
> after making some SA tweaks.   
> 
I do something similar with with collection of test messages, mostly
received spam, that I use to test my local SA rule set.

Essentially, all I do is:

1) remove all headers starting with 'X-Spam', otherwise the X-Spam
   headers injected when the piece if spam was received will still be
   there after I've run the test. This is confusing rather than harmful,
   but the cleaner is just a script using awk. See below.

2) pass the message through spamd by running:

        spamc --max-size=2000000 <testmag.txt | less

   and examine the result

Here's the cleaner script. 
My spam corpus lives in the 'data' directory in my spam test user:
============================== cleaner ==============================
#!/bin/bash
#
#help
#Syntax:   cleaner [file...]
#Function: Remove SA headers from example message(s)
#          If a list of files is present they are processed.
#          If no list is supplied, all files in data/* are processed.
#Options:  none
#end
#
if [ "$1" == '-?' ]
then
        script_help cleaner
        exit
fi

function clean()
{
        echo "Cleaning $1" 
        gawk '
                BEGIN           { act = "copy";
                                  body = "no";
                                }
                /^[A-Za-z]/     { act = "copy"    }
                /^X-Spam/       { act = "skip"    }
                /^$/            { body = "yes"; }
                                {  
                                  if (act == "copy" || body == "yes")
                                        { print }
                                }
        ' <$1 >temp.txt
        mv temp.txt $1
}

if [ $# -gt 0 ]
then
        for f in $*
        do
                clean $f
        done
else
        for f in data/*.txt
        do
                clean $f
        done
fi
========================== end of cleaner ===========================

Martin


Reply via email to