sa-updates/20_imageinfo.cf

   1 # SpamAssassin rules file: Image information tests
   2 #
   3 # Please don't modify this file as your changes will be overwritten with
   4 # the next update. Use /etc/mail/spamassassin/local.cf instead.
   5 # See 'perldoc Mail::SpamAssassin::Conf' for details.
   6 #
   7 # <@LICENSE>
   8 # Licensed to the Apache Software Foundation (ASF) under one or more
   9 # contributor license agreements.  See the NOTICE file distributed with
  10 # this work for additional information regarding copyright ownership.
  11 # The ASF licenses this file to you under the Apache License, Version 2.0
  12 # (the "License"); you may not use this file except in compliance with
  13 # the License.  You may obtain a copy of the License at:
  14 #
  15 #     http://www.apache.org/licenses/LICENSE-2.0
  16 #
  17 # Unless required by applicable law or agreed to in writing, software
  18 # distributed under the License is distributed on an "AS IS" BASIS,
  19 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  20 # See the License for the specific language governing permissions and
  21 # limitations under the License.
  22 # </@LICENSE>
  23 #
  24 ###########################################################################
  25
  26 ifplugin Mail::SpamAssassin::Plugin::ImageInfo
  27
  28 ## # you can match by image name
  29 ## body         DC_IMAGE001_GIF         eval:image_named('image001.gif')
  30 ## describe     DC_IMAGE001_GIF         Contains image named image001.gif
  31
  32 ## # you can do exact image size matches
  33 ## body         DC_GIF_264_127          eval:image_size_exact('gif','264','127')
  34 ## describe     DC_GIF_264_127          Found 264x127 pixel gif, possible pillz
  35
  36 # you can do image to text, or image to html ratios
  37 rawbody         __DC_IMG_HTML_RATIO     eval:image_to_text_ratio('all', '0.000', '0.015')
  38 describe        __DC_IMG_HTML_RATIO     Low rawbody to pixel area ratio
  39
  40 body            __DC_IMG_TEXT_RATIO     eval:image_to_text_ratio('all', '0.000', '0.008')
  41 describe        __DC_IMG_TEXT_RATIO     Low body to pixel area ratio
  42
  43 # body          DC_GIF_TEXT_RATIO       eval:image_to_text_ratio('gif',0.000, 0.008)
  44 # describe      DC_GIF_TEXT_RATIO       Low body to GIF pixel area ratio
  45
  46 # rawbody       DC_GIF_HTML_RATIO       eval:image_to_text_ratio('gif',0.000, 0.008)
  47 # describe      DC_GIF_HTML_RATIO       Low rawbody to GIF pixel area ratio
  48
  49 # using exact size match to identify things like screenshots
  50 # body          __SCREEN_640x480        eval:image_size_exact('all',800,600)
  51 # body          __SCREEN_800x600        eval:image_size_exact('all',800,600)
  52 # body          __SCREEN_1024x768       eval:image_size_exact('all',1024,768)
  53 # body          __SCREEN_1280x1024      eval:image_size_exact('all',1280,1024)
  54 # meta          DC_SCREENSHOT_JPG       ( __SCREEN_640x480 || __SCREEN_800x600 || __SCREEN_1024x768 || __SCREEN_1280x1024 )
  55 # describe      DC_SCREENSHOT_JPG       Contains image matching common screen resolution
  56 # score         DC_SCREENSHOT_JPG       -0.01
  57
  58 # you can do minimum demension matches
  59 # body          DC_GIF_300              eval:image_size_range('gif',300,300)
  60 # describe      DC_GIF_300              Contains a 300x300 pixels gif or larger
  61 # score         DC_GIF_300              0.01
  62
  63 # you can do ranged demension matches
  64 # body          DC_JPEG_200_300         eval:image_size_range('gif', 200, 300, 250, 350)
  65 # describe      DC_JPEG_200_300         Contains jpeg 200-250 (high) x 300-350 (wide)
  66 # score         DC_JPEG_200_300         0.01
  67
  68 # you can count the number of images (all or by image type)
  69 body            __GIF_ATTACH_1          eval:image_count('gif','1','1')
  70 body            __GIF_ATTACH_2P         eval:image_count('gif','2')
  71
  72 body            __PNG_ATTACH_1          eval:image_count('png','1','1')
  73 body            __PNG_ATTACH_2P         eval:image_count('png','2')
  74
  75 body            __JPEG_ATTACH_1         eval:image_count('jpeg',1,1)
  76 body            __JPEG_ATTACH_2P        eval:image_count('jpeg',2)
  77
  78 # you can determine pixel coverage (all or by image type)
  79 body            __GIF_AREA_180K         eval:pixel_coverage('gif','180000','475000')
  80 body            __PNG_AREA_180K         eval:pixel_coverage('png','180000','475000')
  81 # body          __JPEG_AREA_180K        eval:pixel_coverage('jpeg',180000,475000)
  82
  83 # meta together something useful
  84 meta            DC_GIF_UNO_LARGO        ( __GIF_ATTACH_1 && __GIF_AREA_180K )
  85 describe        DC_GIF_UNO_LARGO        Message contains a single large gif image
  86
  87 meta            __DC_GIF_MULTI_LARGO    ( __GIF_ATTACH_2P && __GIF_AREA_180K )
  88 describe        __DC_GIF_MULTI_LARGO    Message has 2+ inline gif covering lots of area
  89
  90 meta            DC_PNG_UNO_LARGO        ( __PNG_ATTACH_1 && __PNG_AREA_180K )
  91 describe        DC_PNG_UNO_LARGO        Message contains a single large png image
  92
  93 meta            __DC_PNG_MULTI_LARGO    ( __PNG_ATTACH_2P && __PNG_AREA_180K )
  94 describe        __DC_PNG_MULTI_LARGO    Message has 2+ png images covering lots of area
  95
  96 # meta          DC_JPEG_UNO_LARGO       ( __JPEG_ATTACH_1 && __JPEG_AREA_180K )
  97 # describe      DC_JPEG_UNO_LARGO       Message hash single large jpeg image
  98
  99 # meta          DC_JPEG_MULTI_LARGO     ( __JPEG_ATTACH_2P && __JPEG_AREA_180K )
 100 # describe      DC_JPEG_MULTI_LARGO     Message has 2+ jpeg images covering lots of area
 101
 102 meta            DC_IMAGE_SPAM_TEXT              ( !__HAS_URI && __DC_IMG_TEXT_RATIO && ( DC_GIF_UNO_LARGO || DC_PNG_UNO_LARGO || __DC_GIF_MULTI_LARGO || __DC_PNG_MULTI_LARGO ))
 103 describe        DC_IMAGE_SPAM_TEXT              Possible Image-only spam with little text
 104
 105 # meta the stock rules together for HTML_IMAGE_ONLY_*
 106 meta            __HTML_IMG_ONLY                 ( HTML_IMAGE_ONLY_04 || HTML_IMAGE_ONLY_08 || HTML_IMAGE_ONLY_12 || HTML_IMAGE_ONLY_16 || HTML_IMAGE_ONLY_20 || HTML_IMAGE_ONLY_24 || HTML_IMAGE_ONLY_28 )
 107
 108 meta            DC_IMAGE_SPAM_HTML              (!__HAS_URI && ( __HTML_IMG_ONLY  || __DC_IMG_HTML_RATIO ) && ( DC_GIF_UNO_LARGO || DC_PNG_UNO_LARGO || __DC_GIF_MULTI_LARGO || __DC_PNG_MULTI_LARGO ))
 109 describe        DC_IMAGE_SPAM_HTML              Possible Image-only spam
 110
 111 endif