From = to

[Antony Stone]

On Saturday 19 July 2003 10:45 pm, Antony Stone wrote:

> Is there any mileage in creating yourself a SpamAssassin rule which picks
> up on From=To, and assigning it a high enough score that it reaches your
> MailScanner High Spam Score, which you can then delete?

This seemed like a neat opportunity to write my first SpamAssassin rule, so I
thought I'd give it a try.

I came up with this:

In the file /usr/lib/perl5/site_perl/Mail/SpamAssassin/EvalTests.pm there is
already a function called check_for_from_to_same (which is badly named,
because it explicitly does *not* match the from and to addresses being
identical - only if they are 'similar'....)

Using this as a template, I created a new function:

sub check_for_from_to_identical {
  my ($self) = @_;

  my $addr_from = $self->get('From:addr');
  my $addr_to = $self->get('To:addr');
  $addr_from =~ s/\s+//g;
  $addr_to =~ s/\s+//g;
  return 1 if ($addr_from eq $addr_to);
  return 0;
}

I then added three lines to /opt/MailScanner/etc/spam.assassin.prefs.conf:

header FROM_AND_TO_IDENTICAL eval:check_for_from_to_identical()
describe FROM_AND_TO_IDENTICAL From and To are the same address
score FROM_AND_TO_IDENTICAL 20

The only thing which bothers me slightly about this idea is that I think I
see some emails from genuine mailing lists which set the from and to
addresses to the same thing - I disapprove of that, but it would lead to some
false positivies if the mailing lists aren't whitelisted....

Anyway, have fun,

Antony.

--

It is also possible that putting the birds in a laboratory setting
inadvertently renders them relatively incompetent.

 - Daniel C Dennett