Martin, What would be the change in spam rule if the Content-Disposition field is mime word encoded as per RFC 2047 ?
Please find the sample eml at: http://pastebin.com/FLjzCsUZ thanks Ashish -----Original Message----- From: Martin Gregorie [mailto:mar...@gregorie.org] Sent: Sunday, March 10, 2013 2:46 AM To: users@spamassassin.apache.org Subject: Re: Checking for email attachment name for containing Javscript code that could get potentially executed when displayed on a webpage. On Sat, 2013-03-09 at 20:56 +0000, Martin Gregorie wrote: Correction: > describe SCRIPTED_NAME Attachment name or filename is a script > mimeheader __SCRIPTN1 Content-Type =~ /name.*\=.*<script>/ > mimeheader __SCRIPTN2 Content-Disposition =~ /filename.*\=.*<script>/ > meta SCRIPTED_NAME (__SCRIPTN1 || __SCRIPTN2) > score SCRIPTED_NAME 6.0 > > I made an editing mistake when shortening the rule names so __SCRIPTN2 wouldn't wrap when posted. Grrrrr. Martin
