"Spam Actions" setting containing attachment and deliver not encapsulating message

[Shawn Iverson]

https://github.com/MailScanner/v5/issues/607

On 9/5/22 15:32, Shawn Iverson via MailScanner wrote:
>
> Ahh, the header still has the old boundary. That is a problem.
>
> On 9/5/22 15:23, Shawn Iverson via MailScanner wrote:
>>
>> Interesting, apparently the client is interacting with the way 
>> MailScanner is encapsulating the message. The raw message is 
>> encapsulated, but my client (Thunderbird) is ignoring it and parsing 
>> just the inner MIME tree.
>>
>>
>> On 9/5/22 15:06, Shawn Iverson via MailScanner wrote:
>>
>>> Confirmed unexpected behavior, more debugging and testing in progress.
>>>
>>> On 8/30/22 08:50, Ricky Boone wrote:
>>>> Thank you, Shawn, for the quick response.  If there's anything I 
>>>> can do to help with either the research and/or troubleshooting 
>>>> around this, please let me know.  I am by no means a competent Perl 
>>>> dev, but my management is very interested in getting this working 
>>>> properly (not meaning to add any pressure or assume expectations), 
>>>> and I'm a bit stuck at the moment.
>>>>
>>>> On Tue, Aug 23, 2022 at 4:22 PM Shawn Iverson via MailScanner 
>>>> <mailscanner at lists.mailscanner.info> wrote:
>>>>
>>>>     That doesn't seem desirable. This should be reproduceable,  so
>>>>     give me some time to lab this up and see what I can find out.
>>>>     It wouldn't be the first time we've found interesting things
>>>>     lurking in the perl mines.
>>>>
>>>>     On 8/23/22 14:34, Ricky Boone wrote:
>>>>>
>>>>>     *Warning: This message originated from outside the
>>>>>     organization. Use caution when following links or opening
>>>>>     attachments.*
>>>>>
>>>>>     I'm troubleshooting an issue with a setting change we're
>>>>>     trying to test in our environment to provide users with
>>>>>     notifications that a message was flagged as spam, and why, as
>>>>>     well as to attach the original message to that notification.
>>>>>
>>>>>     Based on the configuration docs and previous conversations,
>>>>>     this should be handled by including 'attachment' in the Spam
>>>>>     Actions setting (though some references note 'attachment'
>>>>>     along with 'deliver').  What I'm seeing, however, is that it
>>>>>     is not behaving as described.  When the rule only includes
>>>>>     'attachment', no message is fully delivered. When it includes
>>>>>     'attachment' and 'deliver' (regardless of order, understanding
>>>>>     that it shouldn't matter), I get the message with the
>>>>>     '{Spam?}' subject prefix, but otherwise not encapsulated and
>>>>>     not including a notification message.  When attempting with
>>>>>     'attachment' and 'notify', I only get the notification, and if
>>>>>     'attachment', 'deliver', and 'notify' are included, I get both
>>>>>     the non-encapsulated spam message and the notification without
>>>>>     an attachment.
>>>>>
>>>>>     Prior to opening an issue in the GitHub project, I just want
>>>>>     to be sure I'm not doing something incorrectly.
>>>>>
>>>>>     For reference, I'm currently running MailScanner 5.3.3 (aware
>>>>>     that there are newer versions, but none that appear to be
>>>>>     relevant to address this issue based on the changelog) on
>>>>>     CentOS 7 with postfix as the MTA, along with MailWatch
>>>>>     1.2.15.  Spam Actions points to a custom rules file with a
>>>>>     default (FromOrTo) action set to 'store notify header
>>>>>     "X-Spam-Status: Yes"', but I have a To email address for
>>>>>     testing with 'store attachment deliver header "X-Spam-Status:
>>>>>     Yes"' (though I've tried this without deliver, removing store
>>>>>     and header, with notify, etc.).
>>>>>
>>>>>     The logs seem to reflect my settings, depending on what I've
>>>>>     saved and reloaded.  For example, if I have attachment and
>>>>>     deliver set, I see this in the logs:
>>>>>
>>>>>     Aug 23 14:03:37 MailScanner[24433]: Delivery of spam: message
>>>>>     0BD1220625B0.AB434 from [removed] to [removed] with subject
>>>>>     Re: Test message
>>>>>     Aug 23 14:03:37 MailScanner[24433]: Spam Actions: message
>>>>>     0BD1220625B0.AB434 actions are attachment,store,deliver,header
>>>>>     Aug 23 14:03:39 MailScanner[24433]: Requeue:
>>>>>     0BD1220625B0.AB434 to E965720625AA
>>>>>
>>>>>     And if I have only attachment set:
>>>>>
>>>>>     Aug 23 11:57:15 MailScanner[22466]: Non-delivery of spam:
>>>>>     message 8225F206258E.AB9CA from  [removed] to [removed] with
>>>>>     subject Test message
>>>>>     Aug 23 11:57:15 MailScanner[22466]: Spam Actions: message
>>>>>     8225F206258E.AB9CA actions are attachment,store,header
>>>>>
>>>>>
>>>>
>>>>
>>>>     -- 
>>>>     MailScanner mailing list
>>>>     mailscanner at lists.mailscanner.info
>>>>     http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>>
>>>>
>>>
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20220905/8069cc71/attachment.html>