Double File extension

[Rick Cooper]

Johan Hendriks wrote:
> Hello all.
> 
> I have mailscanner running and it all works quite well.
> The only thing i encounter is that people use a lot of (.) in there
> files, and this triggers the deny rule of multiple extensions.
> 
> Is there a way to only check the last two extensions, and only block
> if both are three caracters long?
> 
> regards
> 
> Johan

An express like .*\.(.+?)\.(?:exe|com|bin|msi|scr|vb[es]|bat|chf|cmd|pif)$

Would block double extensions where the final extension is executable so
doc.jan.xls would not trigger but doc.jan.xls.exe would. Of course you still
have to block executables within archives because renaming doc.jan.exe to
doc.jan.txt would defeat the filename rules. And you would also have to
decide what extensions to block because maybe you don't care about .msi
files or shortcuts

Rick