From: Vsevolod Stakhov <vsevolod@highsecure.ru>
Date: Thu, 26 Nov 2015 15:30:23 +0000 (+0000)
Subject: Add SUBJ_ALL_CAPS rule
X-Git-Tag: 1.1.0~470
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b840e3afa41c0e7a53de05e989bc647b08fe842d;p=thirdparty%2Frspamd.git

Add SUBJ_ALL_CAPS rule
---

diff --git a/rules/misc.lua b/rules/misc.lua
index f423d014e9..256255145a 100644
--- a/rules/misc.lua
+++ b/rules/misc.lua
@@ -27,11 +27,13 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 -- This is main lua config file for rspamd
 
 local util = require "rspamd_util"
+local rspamd_regexp = require "rspamd_regexp"
+local rspamd_logger = require "rspamd_logger"
 
 local reconf = config['regexp']
 
-
 -- Uncategorized rules
+local subject_re = rspamd_regexp.create('/^(?:(?:Re|Fwd|Fw|Aw|Antwort|Sv):\\s*)+(.+)$/i')
 
 -- Local rules
 local r_bgcolor = '/BGCOLOR=/iP'
@@ -109,3 +111,25 @@ rspamd_config.R_SUSPICIOUS_URL = {
   one_shot = true,
   description = 'Obfusicated or suspicious URL has been found in a message'
 }
+
+rspamd_config.SUBJ_ALL_CAPS = {
+  callback = function(task)
+    local sbj = task:get_header('Subject')
+
+    if sbj then
+      local stripped_subject = subject_re:search(sbj, false, true)
+      if stripped_subject and stripped_subject[1] and stripped_subject[1][2] then
+        sbj = stripped_subject[1][2]
+      end
+
+      if util.is_uppercase(sbj) then
+        return true
+      end
+    end
+
+    return false
+  end,
+  score = 3.0,
+  group = 'headers',
+  description = 'All capital letters in subject'
+}