OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
PCRE Case matching

From: Jesse Long (jplunknown.za.net)
Date: Sun Jan 02 2005 - 22:28:39 CST


Hi,

I have the following PCRE restriction on incoming mail
((mime_|nested_)?header_checks). This does block *.exe, but allows
*.EXE. Surely the /i would mean "dont worry about case"?

Is there something I'm doing wrong?

/^((Content-(Disposition: attachment;|Type:).*|\ +)| *)(file)?name\ *=\
*"?.*\.(exe|vbs|vb|js|com|bat|dll|zip|scr|msc|reg|pif)"?/i REJECT
Unwanted or dangerous attachment type

PS. From header_checks(5) I gather I need both mime_ and nested_ header
checks to be 100% sure. Is this correct?

Cheers,
Jesse