"Banned Content" question

[Julian Field]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

If you have told it to disarm web bugs, it has to search the message for
them, at which point it will also disarm them. I think that's how it
works... :-)

Quentin Campbell wrote:

>Julian
>
>If the only thing I have told MailScanner to "disarm" are web bugs, then
>why is it apparently finding web bugs in mail that contain no <Img> tags
>in the HTML?
>
>The mail in question probably orginates as RTF from Outlook clients.
>
>Quentin
>---
>PHONE: +44 191 222 8209    Information Systems and Services (ISS),
>                           University of Newcastle,
>                           Newcastle upon Tyne,
>FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
>------------------------------------------------------------------------
>"Any opinion expressed above is mine. The University can get its own."
>
>
>
>>-----Original Message-----
>>From: MailScanner mailing list
>>[mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Julian Field
>>Sent: 11 January 2005 15:15
>>To: MAILSCANNER at JISCMAIL.AC.UK
>>Subject: Re: "Banned Content" question
>>
>>It will disarm those features you told it to. The "disarm HTML" in the
>>message means it will be trying to disarm the requested bits of the
>>HTML. If you didn't specify "disarm" then it won't do it, it will only
>>disarm the bits you told it to.
>>
>>Hope that answers your question. Given a question "a or b" the answer
>>cannot easily be "yes" :-)
>>
>>Quentin Campbell wrote:
>>
>>
>>
>>>Most of the "dangerous content" checks that I carry out with
>>>
>>>
>>MailScanner
>>
>>
>>>are controlled via rules files. In all cases the actions of
>>>
>>>
>>the rules is
>>
>>
>>>to either "deliver", "delete", "striphtml" or "attachment".
>>>
>>>I do not use "disarm" with one exception. In MailScanner.conf I have
>>>
>>> Allow WebBugs = disarm
>>>
>>>If I see in the logs "Content Checks: Detected and will disarm HTML
>>>message in jBAtTRU022337" does this _only_ refer to the "disarming" of
>>>web bugs or can it also refer to actions taken over other
>>>
>>>
>>content which
>>
>>
>>>did not involve the specific "disarm" action?
>>>
>>>Looking at the log records for other "dangerous content" actions the
>>>empirical answer to the above question is "yes". Could this
>>>
>>>
>>be confirmed
>>
>>
>>>please.
>>>
>>>Thanks
>>>
>>>Quentin
>>>---
>>>PHONE: +44 191 222 8209    Information Systems and Services (ISS),
>>>                          University of Newcastle,
>>>                          Newcastle upon Tyne,
>>>FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
>>>--------------------------------------------------------------
>>>
>>>
>>----------
>>
>>
>>>"Any opinion expressed above is mine. The University can get its own."
>>>
>>>------------------------ MailScanner list ------------------------
>>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>'leave mailscanner' in the body of the email.
>>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>>Support MailScanner development - buy the book off the website!
>>>
>>>
>>>
>>>
>>>
>>--
>>Julian Field
>>www.MailScanner.info
>>Buy the MailScanner book at www.MailScanner.info/store
>>
>>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>
>>
>>
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!