From: Vsevolod Stakhov <vsevolod@highsecure.ru>
Date: Sun, 24 Jan 2016 14:10:33 +0000 (+0000)
Subject: Add rule to detect spammers attempts to cheat mime parsing
X-Git-Tag: 1.1.2~60
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1678075da31b6939396a95b9aa2c93c90ee7485b;p=thirdparty%2Frspamd.git

Add rule to detect spammers attempts to cheat mime parsing
---

diff --git a/rules/misc.lua b/rules/misc.lua
index 90767d70c3..e496032785 100644
--- a/rules/misc.lua
+++ b/rules/misc.lua
@@ -185,3 +185,36 @@ rspamd_config.HEADER_FORGED_MDN = {
   group = 'headers',
   description = 'Read confirmation address is different to return path'
 }
+
+local headers_unique = {
+  'Content-Type',
+  'Content-Transfer-Encoding',
+  'Date',
+  'Message-ID'
+}
+
+rspamd_config.MULTIPLE_UNIQUE_HEADERS = {
+  callback = function (task)
+    local res = 0
+    local res_tbl = {}
+    
+    for i,hdr in ipairs(headers_unique) do
+      local h = task:get_header_full(hdr)
+      
+      if h and #h > 1 then
+        res = res + 1
+        table.insert(res_tbl, hdr)
+      end
+    end
+    
+    if res > 0 then
+      return true,res,table.concat(res_tbl, ',')
+    end
+    
+    return false
+  end,
+
+  score = 5.0,
+  group = 'headers',
+  description = 'Repeated unique headers'
+}