Re: Procmail attachment filtering

[Oliver Fuchs <oliverfuchs1@gmx.de>]

On Fri, 20 Dec 2002, Tom Badran wrote:

> On Friday 20 Dec 2002 10:14 am, Oliver Fuchs wrote:
> > I found this:
> > :0
> >
> > * [ ]*(Content|(file)?name=).*\.(scr|exe|p(if|as)|v(bs|xd)|ba[kt]|\
> >   wab|cp(p|l)|asp|xls|mpe?g|reg|ini|d(iz|ll)|sys)
> > { do stuff }
> 
> I tried this but it seems to filter out _all_ messages. Any chance you 
> possibly made a typo? I dont know enough about procmail to spot any mistakes 
> in your filter.
> 

You can also try (from Simon Powell):

:0 H
*^Content-type: (multipart/mixed)
{
	#
	# Look at the body to find out if there is some .ocb or .vbs
	# or... attached,
	# if yes, send the mail to /dev/null

    :0 B
     *^Content-Disposition: (attachment|inline)
     *filename=".*\.(ocx|vbs|wsf|shs|exe|com|bat|chm|pif|vbe|hta|scr)"
     {
        :0
        /dev/null
     }
	#.... other rules
}
	#Substitute whatever attachments you don't want but I'm just parannoid!

See also:


http://www.rosat.mpe-garching.mpg.de/cgi-bin/w3glimpse/procmail?query=attachment&errors=0&case=on&maxfiles=100&maxlines=30

Oliver
-- 
... don't touch the bang bang fruit