On Tue, May 05, 2020 at 12:51:36PM -0400, Rick Cooper wrote:
> We received a couple emails yesterday that barely got caught and when I
> looked at them they should have hit big time. As I looked it would appear
> the body parts are encoded quoted-printable utf-7. Apparently SA doesn't
> handle utf-7?
>
> I added $self->{'decoded'} = Encode::decode("UTF-7", $self->{'decoded'});
> just before the decoded body is returned in Node.pm and the body rules hit
> again including some quick tests I put together.
>
> Is ignoring utf-7 intentional or is this a new spammer tactic? The actual
> email messages are rendered perfectly through outlook and our webmail
> application.
If I remember right, normalize_charset 1 will handle this just fine.
Atleast in trunk/4.0.
In any case, UTF-7 mails can be blocked on sight, no one uses it
legimately..
