new spam getting through

[Steve Freegard]

On 06/12/10 16:04, Peter Ong wrote:
> To further test, here's what I did.
>
> I created an empty text file. Pasted only the shortened urls in them. Then, I ran spamassassin on them:
>
> I ran:
> spamassassin -t<  spam3.txt
> spam3.txt is the text file I created with only the shortened urls inside.
>
> ------------=_4CFD0930.09ACA586
> Content-Type: message/rfc822; x-spam-type=original
> Content-Description: original message before SpamAssassin
> Content-Disposition: inline
> Content-Transfer-Encoding: 8bit
>
> https://mail021.dti/zimbra/
> http://goo.gl/m4PzL
>
> ------------=_4CFD0930.09ACA586--

^^^ That is not a valid RFC822 message; which is the problem - SA saw a 
completely empty message (hence EMPTY_MESSAGE rule fired).

Create a file like this:

---- CUT HERE ----
Subject: testing
Content-type: text/plain

<paste shortened URLs here>
---- CUT HERE -----

Then run it through SA like this:

spamassassin -D -t < file 2>&1 | grep DecodeShortURLs

And if you are still running 3.2.5 it won't work based on a previous bug 
report; you'll need to be running 3.3.1 due to a bug in 3.2.5 causing 
eval rules to be merged incorrectly.

Regards,
Steve.