JFIF $
d d 7
Viewing File: /var/lib/spamassassin/4.000001/updates_spamassassin_org/20_imageinfo.cf
# SpamAssassin rules file: Image information tests
#
# Please don't modify this file as your changes will be overwritten with
# the next update. Use /etc/mail/spamassassin/local.cf instead.
# See 'perldoc Mail::SpamAssassin::Conf' for details.
#
# <@LICENSE>
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to you under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at:
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# </@LICENSE>
#
###########################################################################
ifplugin Mail::SpamAssassin::Plugin::ImageInfo
## # you can match by image name
## body DC_IMAGE001_GIF eval:image_named('image001.gif')
## describe DC_IMAGE001_GIF Contains image named image001.gif
## # you can do exact image size matches
## body DC_GIF_264_127 eval:image_size_exact('gif','264','127')
## describe DC_GIF_264_127 Found 264x127 pixel gif, possible pillz
# you can do image to text, or image to html ratios
rawbody __DC_IMG_HTML_RATIO eval:image_to_text_ratio('all', '0.000', '0.015')
describe __DC_IMG_HTML_RATIO Low rawbody to pixel area ratio
body __DC_IMG_TEXT_RATIO eval:image_to_text_ratio('all', '0.000', '0.008')
describe __DC_IMG_TEXT_RATIO Low body to pixel area ratio
# body DC_GIF_TEXT_RATIO eval:image_to_text_ratio('gif',0.000, 0.008)
# describe DC_GIF_TEXT_RATIO Low body to GIF pixel area ratio
# rawbody DC_GIF_HTML_RATIO eval:image_to_text_ratio('gif',0.000, 0.008)
# describe DC_GIF_HTML_RATIO Low rawbody to GIF pixel area ratio
# using exact size match to identify things like screenshots
# body __SCREEN_640x480 eval:image_size_exact('all',800,600)
# body __SCREEN_800x600 eval:image_size_exact('all',800,600)
# body __SCREEN_1024x768 eval:image_size_exact('all',1024,768)
# body __SCREEN_1280x1024 eval:image_size_exact('all',1280,1024)
# meta DC_SCREENSHOT_JPG ( __SCREEN_640x480 || __SCREEN_800x600 || __SCREEN_1024x768 || __SCREEN_1280x1024 )
# describe DC_SCREENSHOT_JPG Contains image matching common screen resolution
# score DC_SCREENSHOT_JPG -0.01
# you can do minimum demension matches
# body DC_GIF_300 eval:image_size_range('gif',300,300)
# describe DC_GIF_300 Contains a 300x300 pixels gif or larger
# score DC_GIF_300 0.01
# you can do ranged demension matches
# body DC_JPEG_200_300 eval:image_size_range('gif', 200, 300, 250, 350)
# describe DC_JPEG_200_300 Contains jpeg 200-250 (high) x 300-350 (wide)
# score DC_JPEG_200_300 0.01
# you can count the number of images (all or by image type)
body __GIF_ATTACH_1 eval:image_count('gif','1','1')
body __GIF_ATTACH_2P eval:image_count('gif','2')
body __PNG_ATTACH_1 eval:image_count('png','1','1')
body __PNG_ATTACH_2P eval:image_count('png','2')
body __JPEG_ATTACH_1 eval:image_count('jpeg',1,1)
body __JPEG_ATTACH_2P eval:image_count('jpeg',2)
# you can determine pixel coverage (all or by image type)
body __GIF_AREA_180K eval:pixel_coverage('gif','180000','475000')
body __PNG_AREA_180K eval:pixel_coverage('png','180000','475000')
# body __JPEG_AREA_180K eval:pixel_coverage('jpeg',180000,475000)
# meta together something useful
meta DC_GIF_UNO_LARGO ( __GIF_ATTACH_1 && __GIF_AREA_180K )
describe DC_GIF_UNO_LARGO Message contains a single large gif image
meta __DC_GIF_MULTI_LARGO ( __GIF_ATTACH_2P && __GIF_AREA_180K )
describe __DC_GIF_MULTI_LARGO Message has 2+ inline gif covering lots of area
meta DC_PNG_UNO_LARGO ( __PNG_ATTACH_1 && __PNG_AREA_180K )
describe DC_PNG_UNO_LARGO Message contains a single large png image
meta __DC_PNG_MULTI_LARGO ( __PNG_ATTACH_2P && __PNG_AREA_180K )
describe __DC_PNG_MULTI_LARGO Message has 2+ png images covering lots of area
# meta DC_JPEG_UNO_LARGO ( __JPEG_ATTACH_1 && __JPEG_AREA_180K )
# describe DC_JPEG_UNO_LARGO Message hash single large jpeg image
# meta DC_JPEG_MULTI_LARGO ( __JPEG_ATTACH_2P && __JPEG_AREA_180K )
# describe DC_JPEG_MULTI_LARGO Message has 2+ jpeg images covering lots of area
meta DC_IMAGE_SPAM_TEXT ( !__HAS_URI && __DC_IMG_TEXT_RATIO && ( DC_GIF_UNO_LARGO || DC_PNG_UNO_LARGO || __DC_GIF_MULTI_LARGO || __DC_PNG_MULTI_LARGO ))
describe DC_IMAGE_SPAM_TEXT Possible Image-only spam with little text
# meta the stock rules together for HTML_IMAGE_ONLY_*
meta __HTML_IMG_ONLY ( HTML_IMAGE_ONLY_04 || HTML_IMAGE_ONLY_08 || HTML_IMAGE_ONLY_12 || HTML_IMAGE_ONLY_16 || HTML_IMAGE_ONLY_20 || HTML_IMAGE_ONLY_24 || HTML_IMAGE_ONLY_28 )
meta DC_IMAGE_SPAM_HTML (!__HAS_URI && ( __HTML_IMG_ONLY || __DC_IMG_HTML_RATIO ) && ( DC_GIF_UNO_LARGO || DC_PNG_UNO_LARGO || __DC_GIF_MULTI_LARGO || __DC_PNG_MULTI_LARGO ))
describe DC_IMAGE_SPAM_HTML Possible Image-only spam
endif
Back to Directory
nL+D550H?Mx ,D"v]qv;6*Zqn)ZP 0 !1 A "#a$2Qr D8 a Ri[f\mIykIw0 cuFcRı?lO7к_f˓[C$殷WF<_W ԣs KcëIzyQy /_LKℂ;C",pFA: /]=H ~,ls/9ć:[=/#f;)x {ٛEQ )~ =𘙲r*2~ a _V=' kumF D}KYYC)({ *g&f`툪ry`=^cJ.I](*`wq 1dđ#̩͑0;H]u搂@:~וKL Nsh}OIR*8:2 !lDJVo( 3=M(zȰ+i*NA r6KnSl )!JJӁ* %݉?|D}d5:eP0R;{$X'xF@.ÊB {,WJuQɲRI;9QE琯62fT.DUJ;*cP A\ILNj!J۱+O\ ͔]ޒ SJȧc%ANolՎprULZԛerE2=XDXgVQeӓk yP7U*omQIs,K`)6\G3t?pgjrmۛجwluGtf h9uyP0D;Uڽ"OXlif$)&|ML0Zrm1[HXPlPR0'G=i2N +0e2]] 9VTPO7h(F*癈 '=QVZDF,d߬~TX
G[`le69CR(!S2!P
<0x < !1AQ "Raq02Br#SCTb
?Ζ"]mH5WR7k.ۛ!}Q~+yԏz|@T20S~Kek *zFf^2X*(@8r?CIuI|֓>^ExLgNUY+{.RѪ
τVYTD I62'8Y2 7'\TP.6d&˦@Vqi|8- OΕ]ʔ U=TL8=;6c| !qfF3aů&~$l}'NWUs$Uk^SV:U# 6w++s&r+nڐ{@29 gL
u"TÙM=6 (^"7r} =6YݾlCuhquympǦ
G jhsǜNlɻ}o7 #S6aw4!OSrD57%|?x>L
|/nD6?/8w#[)L7+6〼T ATg ! %5MmZ/c-{1_Je"|^$'O&ޱմ Trb$ w)R$&
N1EtdU3Uȉ1pM" N*(DN yd96.(jQ)X
5cQɎMyW? Q*!R>6=7)Xj5`J]e 8%t!+'!1Q 5 !1 AQaqё#2"0BRb ? Gt^## .llQT $v,,m 㵜5 ubV =sY+@d{N! dnO< .-B; _wJt6;QJd.Qc%p{ 1,sNDdFHI0ГoXшe黅XۢF:)[FGXƹ/w_cMeD,ʡcc. WDtA$j@:) -# u
c1<@ۗ9F)KJ-hpP]_x[qBlbp ʖw q"LFGd ƶ*s+ډ_Zc"? %t[IP 6J]#=ɺVvvCGsGh1 >)6|ey?Lӣm,4GWUi` ]uJVoV DG< SB 6ϏQ@ TiUly OU0kfV~~}SZ@*WUUi##; s/[ =!7}" WN]'(L! ~y5g9T̅JkbM' +s:S + B)v@Mj
e Cf jE 0Y\QnzG1д~Wo{T 9?`Rmyhsy3!HAD]mc1~2L Su7xT;j$`}4->L#vzŏ ILS ֭ T { rjGKC; bpU= -`BsK.SFw4Mq]ZdHS0)tLg