Mailing List Archive

Possibly broken rule test
I just noticed a couple of FPs from a mailing list. The main rule that
triggered is FAKED_HOTMAIL_DAV. It appears to me that meybe there is a
missing /i on this rule. Opinioins?

Note that we have

3.9 FAKED_HOTMAIL_DAV X-Originating-Email header does not match From
X-Originating-Email: [lauracheng18@hotmail.com]
From: Cheng Laura <lauracheng18@HOTMAIL.COM>

Those names seem to be the same except for case on the hostname.

Loren

-----------------------
Return-Path: <owner-directxav@DISCUSS.MICROSOFT.COM>
Received: from DISCUSS.MICROSOFT.COM by DISCUSS.MICROSOFT.COM
(LISTSERV-TCP/IP
release 1.8e) with spool id 1261249 for
DirectXAV@DISCUSS.MICROSOFT.COM; Thu, 11 Mar 2004 05:49:31 -0500
Received: from 207.68.165.38 by WALNUT.EASE.LSOFT.COM (SMTPL release 1.0i)
with
TCP; Thu, 11 Mar 2004 05:49:31 -0500
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
Thu,
11 Mar 2004 02:49:30 -0800
Received: from 202.101.8.194 by sea2fd.sea2.hotmail.msn.com with HTTP; Thu,
11
Mar 2004 10:49:30 GMT
X-Originating-IP: [202.101.8.194]
X-Originating-Email: [lauracheng18@hotmail.com]
X-Sender: lauracheng18@hotmail.com
Mime-Version: 1.0
Content-Type: text/plain; format=flowed
X-OriginalArrivalTime: 11 Mar 2004 10:49:30.0430 (UTC)
FILETIME=[880C35E0:01C40756]
Message-ID: <Sea2-F38FSaNwAa3xBk0000fe5a@hotmail.com>
Date: Thu, 11 Mar 2004 10:49:30 +0000
Reply-To: DirectX Audio and Video Discussions
<DirectXAV@DISCUSS.MICROSOFT.COM>
Sender: DirectX Audio and Video Discussions
<DirectXAV@DISCUSS.MICROSOFT.COM>
From: Cheng Laura <lauracheng18@HOTMAIL.COM>
Subject: [DirectXAV] How IMediaSeeking::SetRate() works?
To: DirectXAV@DISCUSS.MICROSOFT.COM
Precedence: list
Re: Possibly broken rule test [ In reply to ]
At 11:31 AM 3/11/2004, Loren Wilton wrote:
>I just noticed a couple of FPs from a mailing list. The main rule that
>triggered is FAKED_HOTMAIL_DAV. It appears to me that meybe there is a
>missing /i on this rule. Opinioins?

Yes, looks like one of the sub-rules of the meta needs a /i, specifically
__HAS_MSN_FROM.


20_head_tests.cf:header __HAS_MSN_FROM From =~
/(?:hotmail|msn)\.com\b/
20_head_tests.cf:meta FAKED_HOTMAIL_DAV (__HAS_MSN_RCVD_DAV &&
__HAS_MSN_ORIG_EMAIL && !__HAS_MSN_FROM).

However, looking at 3.0 cvs taball from today, this rule is gone anyway,
thus it's a moot point to report it as a bug.