Open Discussion → Classification Headers Inserted In "Body"

Classification Headers Inserted In "Body"

POPFile 1.1.1 - I'm am getting x-text-classification headers in the body of my emails rather than in the header section. Actually there's no line space between the headers and the body and perhaps that creates the difficulty. Whatever, I am getting delivered email with X-Text-Classification: spamdump in a table. It kills email filtering rules on the header and filtering on the body for X-Text-Classification: spamdump fails too. I am starting to accumulate a good number of emails with this difficulty, all of the sudden. This seems to be a potential exploit that renders POPFile as ineffective. 


Subject: -SPAM- (9.0) Find a new nursing assistant job
Date: Fri, 06 Nov 2009 17:25:27 -0700
Mime-Version: 1.0
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Message-ID: <68560402814787705045832681665642734075683025275030802511506768633814786348@11.creditcheckshorten.com>
<table id=3D"Table_01" width=3D"600" height=3D"408" border=3D"0" =
cellpadding=3D"0" cellspacing=3D"0">
<<<<<<<Table Contents snipped for this post>>>>>>>>
X-Text-Classification: spamdump
</table>
Trapper
11/07/09 13:10:59
Tree View Flat View (newer first) Flat View (older first)
  • Message #1102

    Hi,

    Does this message you posted come from your mail client?
    Does it look same in the Single Message View of POPFile?

    I want to see the original message (before POPFile modifies). Can you send it to me (amatubu _at_ gmail.com)?
    You can get it by clicking "Download Message" link at the bottom of the Single Message View page. 

    <table id=3D"Table_01" width=3D"600" height=3D"408" border=3D"0" =
cellpadding=3D"0" cellspacing=3D"0">
<<<<<<<Table Contents snipped for this post>>>>>>>>
X-Text-Classification: spamdump
</table>

    What is in the table tag other than the X-Text-Classification header?
    Other headers, or part of message body?

    Naoki

    amatubu
    11/08/09 09:50:34
    • Message #1103

      I've sent you an email with the info you requested. It includes the full source of the message from thunderbird and a download of the unaltered original from the Single Message View page. I also did a copy/paste of the Single Message View page source info and included it because it definitely differs from the downloaded unaltered message.

      Trapper
      11/08/09 15:10:51
      • Message #1105

        Hi,

        I've sent you an email with the info you requested. It includes the full source of the message from thunderbird and a download of the unaltered original from the Single Message View page. I also did a copy/paste of the Single Message View page source info and included it because it definitely differs from the downloaded unaltered message.

        Thanks.

        I've seen that the original message has no blank line between its header and body. So POPFile treats a part of body as mail header.

        For now, I have no idea how to treat such mails.
        We should insert a blank line if we find malformed header (such as HTML tags)?

        How do you all think?

        Naoki

        amatubu
        11/10/09 12:40:47
Tree View Flat View (newer first) Flat View (older first)