Mailing List Archive

At 04:16 PM 3/9/2004, Mark London wrote:
>Is there a way to test to see if a header is all caps, i.e. a way to tell if a
>header line is FROM: rather than From:? Thanks.
>
>Mark


You mean like this standard rule from SA 2.50 and higher?

header FROM_NO_LOWER From !~ /[a-z]/
describe FROM_NO_LOWER 'From' has no lower-case characters

At 04:34 PM 3/9/2004, Matt Kettler wrote:
>At 04:16 PM 3/9/2004, Mark London wrote:
> >Is there a way to test to see if a header is all caps, i.e. a way to
> tell if a
> >header line is FROM: rather than From:? Thanks.
> >
> >Mark
>
>
>You mean like this standard rule from SA 2.50 and higher?
>
>header FROM_NO_LOWER From !~ /[a-z]/
>describe FROM_NO_LOWER 'From' has no lower-case characters

Whoops.. my bad, that looks for a no-lower email address..

Let's instead look at a rule from sa 2.30 through sa 2.44:

header ALL_CAPS_HEADER ALL =~ /\n(?:TO|FROM|SUBJECT|DATE):/s

Matt Kettler wrote on Tue, 09 Mar 2004 16:34:32 -0500:

> You mean like this standard rule from SA 2.50 and higher?
>
> header FROM_NO_LOWER From !~ /[a-z]/
> describe FROM_NO_LOWER 'From' has no lower-case characters
>

No, he means FROM: instead of the standard From:
It's very typical for several viruses to use FROM:, TO: and SUBJECT: If
you look at those messages, it's the first thing that stands out. I've
never seen that in any other messages, although there may be a few clients
which do this. But it certainly is a good virus sign if you don't use a
virus scanner or want to flag these messages as spam, anyway.


Kai

--

Kai Schätzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com
IE-Center: http://ie5.de & http://msie.winware.org

--On Tuesday, March 09, 2004 9:16 PM +0000 Mark London <mrl@psfc.mit.edu>
wrote:

> Is there a way to test to see if a header is all caps, i.e. a way to tell if
> a header line is FROM: rather than From:? Thanks.

I use this procmail rule:


# case-sensitive header search, SWEN uses FROM, TO, SUBJECT
# note that the ^TO macro has to be escaped to match the literal word TO.

:0 D
* ^FROM:
* \^TO:
* ^SUBJECT:
|/usr/local/bin/dmail +mail/IT/SWEN

My understanding is the header rules need to match on case.
So "From =~" isn't going to match a FROM: header.
A test for "FROM =~" presumably would.

Or probably you could (untested) do something like:

header ALL =~ /^(?:FROM|TO)\:\s/

Loren

----- Original Message -----
From: "Mark London" <mrl@psfc.mit.edu>
To: <spamassassin-users@incubator.apache.org>
Sent: Tuesday, March 09, 2004 1:16 PM
Subject: Testing for all capital headers, like FROM:, TO:, etc. ?


> Is there a way to test to see if a header is all caps, i.e. a way to tell
if a
> header line is FROM: rather than From:? Thanks.
>
> Mark
>