Re: 8bit encoding in mail header by SpamAssassin

On Sun, 2007-10-14 at 16:21 +1000, Lars Ippich wrote:

> > That does *not* look like the default X-Spam-Report header as inserted
> > when using report_safe 0. That looks like a custom added header. And a
> > broken one, frankly...
>
> You can see the header template at
> http://mod.privatepaste.com/16TExHyOgg as it is inserted into the
> local.cf file.

Indeed, a custom template. However, I'm moderately confused...

That config uses report_safe 0, resulting in *not* generating a new message with a text/plain part containing the report and attaching the original message unaltered. *But* altering the original message adding the X-Spam-* headers plus adding another X-Spam-Report header by default, unless specifically cleared.

Note that the X-Spam-Report header and the report template are used with *different* settings, depending on the report_safe value.

Customizing the report text (as can be seen in that config) does not effect the X-Spam-Report header. According to the documentation, and to my real life experience. (Yes, for some strange reason I used to use report_safe 1 with a slightly customized report template until recently. Switched to report_safe 0, and did not yet remove the obsolete report template tweaking. Doesn't matter anyway, since it is not intended to have any effect with report_safe 0. And indeed, it does not for me.)

Yet the pasted config seems to suggest the report template is being picked up for the X-Spam-Report header.

> > The thingy above looks suspiciously like a custom header. The lower
> > part, the rule detail list, is almost identical to the stock
> > report_template used with report_safe 1 or 2 -- placed inside a mail
> > body, FWIW. The part above that seems to be highly customized to me. And
> > the _RELAYCOUNTRY_ string hints that this custom template doesn't work
> > as expected...
>
> It is a custom one. He says he uses it because the original one does not
> include scorings. So how do you enable this output:
>
> > X-Spam-Report:
> > * 4.5 BAYES_99 BODY: Bayesian spam probability is 99 to 100%
> > * [score: 1.0000]
> > * 1.5 IXHASH BODY: classified as spam @ iX Magazine, Germany

Do you need help?
In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related spamassassin.apache.org Links users Request more information about Pantek

As I mentioned earlier, this is how a stock X-Spam-Report header looks like as added by SA. Including the scores. All you need to do is to set report_safe 0.

> > Anyway, even when using the stock X-Spam-Report header with a German
> > locale -- does SA actually use the localized strings?
>
> How to check this?

This part was aiming at the devs. :) They should know. Also, ignoring the weird custom format for now -- this seems to be the culprit. Since the localized German descriptions *do* use 8 bit chars, using these localized descriptions verbatim in headers *will* result in your problem. As hinted in my original, full question:

  Anyway, even when using the stock X-Spam-Report header with a German   locale -- does SA actually use the localized strings?

  This sure would result in possibly sneaking in 8bit chars, even using   iso-8859-1 encoding (which 30_text_de.cf does).

Devs?

One quick workaround is, to set the locales for SA to English or even C. That will get rid of the 8 bit chars. However, still doesn't explain how he managed to customize the X-Spam-Report header...

  guenther

-- 
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}

Do you need more help?
In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related spamassassin.apache.org Links users Request more information about Pantek