| |
| # John Hardin <jhardin@impsec.org> |
| # Spams without a text body part first started appearing in 5/2009 |
| |
| # These should be generally useful to other rules as well |
| |
| header __CTYPE_MULTIPART_ANY Content-Type =~ /multipart\/\w+/i |
| header __PHP_MUA_1 X-Mailer =~ /^PHP\s?v?\/?\d\./ |
| header __PHP_MUA_2 X-Mailer =~ /^PHP\d$/ |
| meta __PHP_MUA __PHP_MUA_1 || __PHP_MUA_2 |
| |
| ifplugin Mail::SpamAssassin::Plugin::MIMEHeader |
| mimeheader __ANY_TEXT_ATTACH Content-Type =~ /text\/\w+/i |
| |
| meta __MIME_NO_TEXT (__CTYPE_MULTIPART_ANY && !__ANY_TEXT_ATTACH) |
| meta MIME_NO_TEXT __MIME_NO_TEXT && !__BOUNCE_CTYPE && !__CT_ENCRYPTED && !ALL_TRUSTED && !__MSGID_APPLEMAIL && !__USER_AGENT_APPLEMAIL && !__HAS_IN_REPLY_TO && !__HAS_X_REF && !__HS_SUBJ_RE_FW && !__PDF_ATTACH && !__LCL__KAM_BODY_LENGTH_LT_128 |
| score MIME_NO_TEXT 2.00 # limit |
| describe MIME_NO_TEXT No (properly identified) text body parts |
| tflags MIME_NO_TEXT publish |
| |
| meta MIME_PHP_NO_TEXT (MIME_NO_TEXT && __PHP_MUA) |
| #score MIME_PHP_NO_TEXT 2.00 |
| describe MIME_PHP_NO_TEXT No text body parts, X-Mailer: PHP |
| else |
| meta __ANY_TEXT_ATTACH 0 |
| meta __MIME_NO_TEXT 0 |
| endif |
| |
