Re: rule for To: undisclosed-recipients:;

[Cedric Knight]

On 25/10/10 04:21, Dennis German wrote:
> Is there? should there be a rule for  a header like:
> To: undisclosed-recipients:;

There was a rule UNDISC_RECIPS in version 3.1, and it scored about 0.8
points.  I don't know why it was removed; presumably it hit too much ham.

It used to go:
header UNDISC_RECIPS                To =~ /^undisclosed-recipients?:\s*;$/

but I personally prefer a wider:
header UNDISC_RECIPS           ToCc =~ /^(?:undisclosed[_
\-]*recipients?|recipient[_ \-]*list[_
\-]*(?:supressed|not[_\-]*shown)):?\s*;/i

Might as well get my 2p's worth in to the related question:

On 24/10/10 19:56, Lawrence @ Rogers wrote:
> What I would like to do is take the Envelope-To and run a regex to
check if the To: header contains it.
>
> Is this possible?

Well, it is possible, and here's some hacky code to show one way of
doing it.  Whether it's desirable is indeed a different matter.

All this would have to be put into a user plugin (see
http://search.cpan.org/dist/Mail-SpamAssassin/lib/Mail/SpamAssassin/Plugin.pm
)

sub get_rcpt_to {
    my $permsgstatus = $_[1];
    my $line = $_[1]->get('X-Envelope-To')
        || $_[1]->get('Envelope-To')
        || $_[1]->get('Envelope-Recipients')
        || $_[1]->get('X-Rcpt-To')
        || $_[1]->get('X-Original-To');
    return $_[1]->{main}->find_all_addrs_in_line ($line);
}

sub is_bcc {
  # call as head rule
  # related to UNDISC_RECIPS
  # hits mailing lists, of course:
  my ($self, $permsgstatus) = @_;
  my $tocc = lc ($permsgstatus -> get('ToCc'));
  my @rcpt_to = $self->get_rcpt_to($permsgstatus);
  my $match = scalar @rcpt_to;
  Mail::SpamAssassin::Plugin::dbg ("is_bcc -  all_to_addrs
@rcpt_to'$match' ToCc '$tocc'");
  return 0 if (! scalar @rcpt_to);
  my $to = lc ($rcpt_to[0]);
  $to =~ s/([?+*{}\[\]\'\/\\\(\)].)/\\$1/g;
  $to =~ s/\@(\w+)\./\...@\(\?:$1\\.\)?/; # make first subdomain optional
  # using index() would be faster:
  return 0 if ($tocc =~ /\b$to(?:$|,|>|\s)/im);
  return 1;
}

I agree it's not useful on it's own, but think it may be as part of a
meta rule for 419 spams and so on.  You'd at least want to limit it like:

header __IS_BCC                 eval:is_bcc()
meta IS_BCC                     (__IS_BCC0 && !__DOS_HAS_LIST_ID &&
!__DOS_HAS_LIST_UNSUB && !__DOS_HAS_MAILING_LIST)
describe IS_BCC                 Envelope recipients not in To or Cc,
prob not list
score IS_BCC                    0.1

HTH

CK