OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: Blocking mails that has only images as body

From: Craig Sanders (castaz.net.au)
Date: Tue May 09 2006 - 19:40:38 CDT


On Tue, May 09, 2006 at 12:03:29AM -0300, Javier Viegas wrote:
> Hi, is there any way to make postfix reject mails that have only images with
> html links as the mail body content? Im receiving lots of mails like this,
> that when i open them to see what can i use from the body or header to use
> it with body and header checks, i found that the body of the mail is only an
> image such as jpg or gif, and no text on it, so i can`t really have body
> checks working.

i use this body_checks rule:

/\bsrc\s*=(?:3D)?\s*"?cid:/ REJECT

this rejects any IMG SRC (or SCRIPT SRC or other embedded object) which refers
to an attachment in the current message (the "cid:" part).

there is some potential for false positives, but i've only had one since i've
been using this rule - i first started using a rule like this a few years ago,
and it has evolved slightly over time.

NOTE: as usual, base64 encoded message texts will bypass body checks.
spamassassin is good at catching them.

craig

--
craig sanders <castaz.net.au> (part time cyborg)

my postfix scripts are at http://taz.net.au/postfix/scripts/