]>
Commit | Line | Data |
---|---|---|
1 | # SpamAssassin rules file: Image information tests | |
2 | # | |
3 | # Please don't modify this file as your changes will be overwritten with | |
4 | # the next update. Use /etc/mail/spamassassin/local.cf instead. | |
5 | # See 'perldoc Mail::SpamAssassin::Conf' for details. | |
6 | # | |
7 | # <@LICENSE> | |
8 | # Licensed to the Apache Software Foundation (ASF) under one or more | |
9 | # contributor license agreements. See the NOTICE file distributed with | |
10 | # this work for additional information regarding copyright ownership. | |
11 | # The ASF licenses this file to you under the Apache License, Version 2.0 | |
12 | # (the "License"); you may not use this file except in compliance with | |
13 | # the License. You may obtain a copy of the License at: | |
14 | # | |
15 | # http://www.apache.org/licenses/LICENSE-2.0 | |
16 | # | |
17 | # Unless required by applicable law or agreed to in writing, software | |
18 | # distributed under the License is distributed on an "AS IS" BASIS, | |
19 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
20 | # See the License for the specific language governing permissions and | |
21 | # limitations under the License. | |
22 | # </@LICENSE> | |
23 | # | |
24 | ########################################################################### | |
25 | ||
26 | ifplugin Mail::SpamAssassin::Plugin::ImageInfo | |
27 | ||
28 | ## # you can match by image name | |
29 | ## body DC_IMAGE001_GIF eval:image_named('image001.gif') | |
30 | ## describe DC_IMAGE001_GIF Contains image named image001.gif | |
31 | ||
32 | ## # you can do exact image size matches | |
33 | ## body DC_GIF_264_127 eval:image_size_exact('gif','264','127') | |
34 | ## describe DC_GIF_264_127 Found 264x127 pixel gif, possible pillz | |
35 | ||
36 | # you can do image to text, or image to html ratios | |
37 | rawbody __DC_IMG_HTML_RATIO eval:image_to_text_ratio('all', '0.000', '0.015') | |
38 | describe __DC_IMG_HTML_RATIO Low rawbody to pixel area ratio | |
39 | ||
40 | body __DC_IMG_TEXT_RATIO eval:image_to_text_ratio('all', '0.000', '0.008') | |
41 | describe __DC_IMG_TEXT_RATIO Low body to pixel area ratio | |
42 | ||
43 | # body DC_GIF_TEXT_RATIO eval:image_to_text_ratio('gif',0.000, 0.008) | |
44 | # describe DC_GIF_TEXT_RATIO Low body to GIF pixel area ratio | |
45 | ||
46 | # rawbody DC_GIF_HTML_RATIO eval:image_to_text_ratio('gif',0.000, 0.008) | |
47 | # describe DC_GIF_HTML_RATIO Low rawbody to GIF pixel area ratio | |
48 | ||
49 | # using exact size match to identify things like screenshots | |
50 | # body __SCREEN_640x480 eval:image_size_exact('all',800,600) | |
51 | # body __SCREEN_800x600 eval:image_size_exact('all',800,600) | |
52 | # body __SCREEN_1024x768 eval:image_size_exact('all',1024,768) | |
53 | # body __SCREEN_1280x1024 eval:image_size_exact('all',1280,1024) | |
54 | # meta DC_SCREENSHOT_JPG ( __SCREEN_640x480 || __SCREEN_800x600 || __SCREEN_1024x768 || __SCREEN_1280x1024 ) | |
55 | # describe DC_SCREENSHOT_JPG Contains image matching common screen resolution | |
56 | # score DC_SCREENSHOT_JPG -0.01 | |
57 | ||
58 | # you can do minimum demension matches | |
59 | # body DC_GIF_300 eval:image_size_range('gif',300,300) | |
60 | # describe DC_GIF_300 Contains a 300x300 pixels gif or larger | |
61 | # score DC_GIF_300 0.01 | |
62 | ||
63 | # you can do ranged demension matches | |
64 | # body DC_JPEG_200_300 eval:image_size_range('gif', 200, 300, 250, 350) | |
65 | # describe DC_JPEG_200_300 Contains jpeg 200-250 (high) x 300-350 (wide) | |
66 | # score DC_JPEG_200_300 0.01 | |
67 | ||
68 | # you can count the number of images (all or by image type) | |
69 | body __GIF_ATTACH_1 eval:image_count('gif','1','1') | |
70 | body __GIF_ATTACH_2P eval:image_count('gif','2') | |
71 | ||
72 | body __PNG_ATTACH_1 eval:image_count('png','1','1') | |
73 | body __PNG_ATTACH_2P eval:image_count('png','2') | |
74 | ||
75 | body __JPEG_ATTACH_1 eval:image_count('jpeg',1,1) | |
76 | body __JPEG_ATTACH_2P eval:image_count('jpeg',2) | |
77 | ||
78 | # you can determine pixel coverage (all or by image type) | |
79 | body __GIF_AREA_180K eval:pixel_coverage('gif','180000','475000') | |
80 | body __PNG_AREA_180K eval:pixel_coverage('png','180000','475000') | |
81 | # body __JPEG_AREA_180K eval:pixel_coverage('jpeg',180000,475000) | |
82 | ||
83 | # meta together something useful | |
84 | meta DC_GIF_UNO_LARGO ( __GIF_ATTACH_1 && __GIF_AREA_180K ) | |
85 | describe DC_GIF_UNO_LARGO Message contains a single large gif image | |
86 | ||
87 | meta __DC_GIF_MULTI_LARGO ( __GIF_ATTACH_2P && __GIF_AREA_180K ) | |
88 | describe __DC_GIF_MULTI_LARGO Message has 2+ inline gif covering lots of area | |
89 | ||
90 | meta DC_PNG_UNO_LARGO ( __PNG_ATTACH_1 && __PNG_AREA_180K ) | |
91 | describe DC_PNG_UNO_LARGO Message contains a single large png image | |
92 | ||
93 | meta __DC_PNG_MULTI_LARGO ( __PNG_ATTACH_2P && __PNG_AREA_180K ) | |
94 | describe __DC_PNG_MULTI_LARGO Message has 2+ png images covering lots of area | |
95 | ||
96 | # meta DC_JPEG_UNO_LARGO ( __JPEG_ATTACH_1 && __JPEG_AREA_180K ) | |
97 | # describe DC_JPEG_UNO_LARGO Message hash single large jpeg image | |
98 | ||
99 | # meta DC_JPEG_MULTI_LARGO ( __JPEG_ATTACH_2P && __JPEG_AREA_180K ) | |
100 | # describe DC_JPEG_MULTI_LARGO Message has 2+ jpeg images covering lots of area | |
101 | ||
102 | meta DC_IMAGE_SPAM_TEXT ( !__HAS_URI && __DC_IMG_TEXT_RATIO && ( DC_GIF_UNO_LARGO || DC_PNG_UNO_LARGO || __DC_GIF_MULTI_LARGO || __DC_PNG_MULTI_LARGO )) | |
103 | describe DC_IMAGE_SPAM_TEXT Possible Image-only spam with little text | |
104 | ||
105 | # meta the stock rules together for HTML_IMAGE_ONLY_* | |
106 | meta __HTML_IMG_ONLY ( HTML_IMAGE_ONLY_04 || HTML_IMAGE_ONLY_08 || HTML_IMAGE_ONLY_12 || HTML_IMAGE_ONLY_16 || HTML_IMAGE_ONLY_20 || HTML_IMAGE_ONLY_24 || HTML_IMAGE_ONLY_28 ) | |
107 | ||
108 | meta DC_IMAGE_SPAM_HTML (!__HAS_URI && ( __HTML_IMG_ONLY || __DC_IMG_HTML_RATIO ) && ( DC_GIF_UNO_LARGO || DC_PNG_UNO_LARGO || __DC_GIF_MULTI_LARGO || __DC_PNG_MULTI_LARGO )) | |
109 | describe DC_IMAGE_SPAM_HTML Possible Image-only spam | |
110 | ||
111 | endif |