Yahoo and "Filename contains lots of white space" rule

[Ricky Boone]

Hello everyone,

I was seeing a disproportionate number of messages from legitimate @
yahoo.com senders hitting our environment that, when they have an
attachment with a long name with spaces, they hit the "Filename contains
lots of white space" rule in filename.rules.conf.  Upon deeper inspection,
it appears it may be something with Yahoo and how they handle spaces when
generating the Content-Disposition header in the message.  In most cases,
when the file name went past a certain number of characters, it was wrapped
to the next line, but with 5-10 blank characters padded to it.

I adjusted the regex in the rule from 10 spaces to 12, but just wanted to
bounce this off the mailing list to see if anyone else had seen similar
behavior.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20210119/01f83caa/attachment.html>