sa-updates/20_ratware.cf

   1 # SpamAssassin rules file: known spam mailers
   2 #
   3 # Sometimes these leave 'sent by mailername' fingerprints in the
   4 # headers, which provide a nice way for us to catch them.
   5 #
   6 # Please don't modify this file as your changes will be overwritten with
   7 # the next update. Use /etc/mail/spamassassin/local.cf instead.
   8 # See 'perldoc Mail::SpamAssassin::Conf' for details.
   9 #
  10 # <@LICENSE>
  11 # Licensed to the Apache Software Foundation (ASF) under one or more
  12 # contributor license agreements.  See the NOTICE file distributed with
  13 # this work for additional information regarding copyright ownership.
  14 # The ASF licenses this file to you under the Apache License, Version 2.0
  15 # (the "License"); you may not use this file except in compliance with
  16 # the License.  You may obtain a copy of the License at:
  17 #
  18 #     http://www.apache.org/licenses/LICENSE-2.0
  19 #
  20 # Unless required by applicable law or agreed to in writing, software
  21 # distributed under the License is distributed on an "AS IS" BASIS,
  22 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  23 # See the License for the specific language governing permissions and
  24 # limitations under the License.
  25 # </@LICENSE>
  26 #
  27 ###########################################################################
  28
  29 header RATWARE_EGROUPS          X-Mailer =~ /eGroups Message Poster/
  30 describe RATWARE_EGROUPS        Bulk email fingerprint (eGroups) found
  31
  32 # Note that the tests which look at the "ALL" pseudoheader are slower than
  33 # the specific header.
  34 # 100% overlap with X-Stormpost-To: header, but seems wise to leave it in
  35 header RATWARE_OE_MALFORMED     X-Mailer =~ /^Microsoft Outlook Express \d(?:\.\d+){3} \w+$/
  36 describe RATWARE_OE_MALFORMED   X-Mailer has malformed Outlook Express version
  37 header RATWARE_MOZ_MALFORMED    User-Agent =~ /Mozilla\/5\.0\d\d/
  38 describe RATWARE_MOZ_MALFORMED  Bulk email fingerprint (Mozilla malformed) found
  39
  40 header RATWARE_MPOP_WEBMAIL     X-Mailer =~ /mPOP Web-Mail/i
  41 describe RATWARE_MPOP_WEBMAIL   Bulk email fingerprint (mPOP Web-Mail)
  42
  43 ###########################################################################
  44 # Now, detect forgeries of real MUAs
  45 #
  46 # NOTE: these rules should specify version numbers!
  47
  48 # first define situations where servers rewrite message id so we can't use message id to detect forgeries
  49
  50 header __HOTMAIL_BAYDAV_MSGID           MESSAGEID =~ /^<[A-Z]{3}\d+-(?:DAV|SMTP)\d+[A-Z0-9]{25}\@phx\.gbl>$/m
  51
  52 header __IPLANET_MESSAGING_SERVER Received =~ /iPlanet Messaging Server/
  53
  54 header __LYRIS_EZLM_REMAILER  List-Unsubscribe =~ /<mailto:(?:leave-\S+|\S+-unsubscribe)\@\S+>$/
  55
  56 header __SYMPATICO_MSGID                MESSAGEID =~ /^<BAYC\d+-PASMTP\d+[A-Z0-9]{25}\@CEZ\.ICE>$/m
  57
  58 header __WACKY_SENDMAIL_VERSION Received =~ /\/CWT\/DCE\)/
  59
  60 header __GROUPSIO_MSGID         MESSAGEID =~ /^<[[:xdigit:]]+\.[[:xdigit:]]+\@groups.io>$/m
  61
  62 header __HAS_XORIGMSGID         X-Orig-Message-Id =~ /^<.+\@.+>$/m
  63
  64 meta   __GROUPSIO_GATED         __GROUPSIO_MSGID && __HAS_XORIGMSGID
  65
  66 meta __UNUSABLE_MSGID (__LYRIS_EZLM_REMAILER || __GATED_THROUGH_RCVD_REMOVER || __WACKY_SENDMAIL_VERSION || __IPLANET_MESSAGING_SERVER || __HOTMAIL_BAYDAV_MSGID || __SYMPATICO_MSGID && __GROUPSIO_GATED)
  67
  68 ## now on to the forgery rules
  69
  70 # AOL
  71 header __AOL_MUA                X-Mailer =~ /\bAOL\b/
  72
  73 # Internet Mail Service
  74 header __IMS_MUA                X-Mailer =~ /Internet Mail Service/
  75 header __IMS_MSGID              MESSAGEID =~ /^<[A-F\d]{36,40}\@\S+>$/m
  76 meta FORGED_MUA_IMS             (__IMS_MUA && !__IMS_MSGID && !__UNUSABLE_MSGID)
  77 describe FORGED_MUA_IMS         Forged mail pretending to be from IMS
  78
  79 # Message ID format introduced by Vista MAPI, maybe also Windows 2003 Server SP2
  80 header __VISTA_MSGID            MESSAGEID =~ /^<[A-F\d]{32}\@\S+>$/m
  81
  82 # Outlook Express 4, 5, and 6
  83 header __OE_MUA                 X-Mailer =~ /\bOutlook Express [456]\./
  84 header __OE_MSGID_1             MESSAGEID =~ /^<[A-Za-z0-9-]{7}[A-Za-z0-9]{20}\@hotmail\.com>$/m
  85 header __OE_MSGID_2             MESSAGEID =~ /^<(?:[0-9a-f]{8}|[0-9a-f]{12})\$[0-9a-f]{8}\$[0-9a-f]{8}\@\S+>$/m
  86 meta __FORGED_OE                (__OE_MUA && !__OE_MSGID_1 && !__OE_MSGID_2 && !__UNUSABLE_MSGID)
  87
  88 # Outlook versions that usually use "dollar signs"
  89 header __OUTLOOK_DOLLARS_MUA    X-Mailer =~ /^Microsoft Outlook(?: 8| CWS, Build 9|, Build 10)\./
  90 header __OUTLOOK_DOLLARS_OTHER  MESSAGEID =~ /^<\!\~\!/m
  91 meta __FORGED_OUTLOOK_DOLLARS   (__OUTLOOK_DOLLARS_MUA && !__OE_MSGID_2 && !__OUTLOOK_DOLLARS_OTHER && !__VISTA_MSGID && !__IMS_MSGID && !__UNUSABLE_MSGID)
  92 # use new meta rules to implement FORGED_MUA_OUTLOOK rule from 2.60
  93
  94 # bug 7567: obviously fake Outlook X-Mailer
  95 header __OUTLOOK_FAKE_MUA       X-Mailer =~ /^Outlook$/
  96
  97 # bug 5496: avoid some FPs
  98 header __FMO_EXCL_O3416   X-Mailer =~ /^Microsoft Outlook, Build 10.0.3416$/
  99 header __FMO_EXCL_OE3790  X-Mailer =~ /^Microsoft Outlook Express 6.00.3790.3959$/
 100 # bug 5910: __VISTA_MSGID also now used by Outlook Express from XP SP3
 101 #
 102 meta FORGED_MUA_OUTLOOK         ((__FORGED_OE || __FORGED_OUTLOOK_DOLLARS || __OUTLOOK_FAKE_MUA) && !__FMO_EXCL_O3416 && !__FMO_EXCL_OE3790 && !__VISTA_MSGID)
 103 describe FORGED_MUA_OUTLOOK     Forged mail pretending to be from MS Outlook
 104
 105 # Outlook IMO (Internet Mail Only)
 106 header __OIMO_MUA               X-Mailer =~ /Outlook IMO/
 107 header __OIMO_MSGID             MESSAGEID =~ /^<[A-P]{28}\.[-\w.]+\@\S+>$/m
 108 meta FORGED_MUA_OIMO            (__OIMO_MUA && !__OIMO_MSGID && !__OE_MSGID_2 && !__UNUSABLE_MSGID)
 109 describe FORGED_MUA_OIMO        Forged mail pretending to be from MS Outlook IMO
 110
 111 # Not Ratware...
 112
 113 header __HAS_X_LOOP             exists:X-Loop
 114 header __HAS_X_MAILING_LIST     exists:X-Mailing-List
 115 header __HAS_X_MAILMAN_VERSION  exists:X-Mailman-Version
 116 describe MAILING_LIST_MULTI     Multiple indicators imply a widely-seen list manager
 117 # __ML2 and __HAS_LIST_ID are exactly equivalent, don't double-count
 118 meta   MAILING_LIST_MULTI       __HAS_X_LOOP + __HAS_X_MAILING_LIST + __HAS_X_MAILMAN_VERSION + __HAS_LIST_ID + __HAS_X_BEEN_THERE +__DOS_HAS_LIST_UNSUB + __ML1 + __ML3 + __ML4 + __ML5 > 2
 119 tflags MAILING_LIST_MULTI       nice
 120
 121 # QUALCOMM Eudora
 122 # Note: uses X_LOOP and X_MAILING_LIST as subrules
 123 # X-Mailer: QUALCOMM Windows Eudora Version 5.0   (and 5.1)
 124 # X-Mailer: QUALCOMM Windows Eudora Version 6.0.0.22
 125 # updated to fix bugs 2047, 2598, 2654
 126 # NOTE: this is the *only* spammish Eudora MUA pattern that wasn't
 127 # ignored using __OLD_EUDORA1 and __OLD_EUDORA2 under previous rules.
 128 # v7 can't be tested, as it sometimes doesn't generate MID
 129 header __EUDORA_MUA             X-Mailer =~ /^QUALCOMM Windows Eudora (?:Pro |Light )?Version [3456]\./
 130 header __EUDORA_MSGID           MESSAGEID =~ /^<(?:\d\d?\.){3,5}\d{14}\.[a-f0-9]{8}\@\S+(?:\sport\s\d+)?>$/m
 131 meta FORGED_MUA_EUDORA          __EUDORA_MUA && !( __EUDORA_MSGID || __UNUSABLE_MSGID || MAILING_LIST_MULTI || MSGID_FROM_MTA_HEADER )
 132 describe FORGED_MUA_EUDORA      Forged mail pretending to be from Eudora
 133
 134 # From private mail with developers.  Some top tips here!
 135 header __THEBAT_MUA             X-Mailer =~ /^The Bat!/
 136 header __THEBAT_MUA_V1          X-Mailer =~ /^The Bat! \(v1\./
 137 #header __THEBAT_MUA_V2         X-Mailer =~ /^The Bat! \(v2\./
 138 #header __THEBAT_MUA_V3         X-Mailer =~ /^The Bat! \(v3\./
 139 header __CTYPE_CHARSET_QUOTED   Content-Type =~ /charset=\"/i
 140 header __CTYPE_HAS_BOUNDARY     Content-Type =~ /boundary/i
 141 header __BAT_BOUNDARY           Content-Type =~ /boundary=\"-{10}[A-F0-9]{4,}\"/
 142 header __MAILMAN_21             X-Mailman-Version =~ /\d/
 143 meta FORGED_MUA_THEBAT_CS       (__THEBAT_MUA && __CTYPE_CHARSET_QUOTED && !__MAILMAN_21)
 144 meta FORGED_MUA_THEBAT_BOUN     (__THEBAT_MUA && __CTYPE_HAS_BOUNDARY && !__BAT_BOUNDARY && !__MAILMAN_21)
 145 describe FORGED_MUA_THEBAT_CS   Mail pretending to be from The Bat! (charset)
 146 describe FORGED_MUA_THEBAT_BOUN Mail pretending to be from The Bat! (boundary)
 147
 148 # bug 4649: bulk mail sent via Yahoo! often looks forged, even when it is not
 149 header __YAHOO_BULK             Received =~ /from \[\S+\] by \S+\.(?:groups|scd|dcn)\.yahoo\.com with NNFMP/
 150
 151 meta FORGED_OUTLOOK_HTML        (!__YAHOO_BULK && __ANY_OUTLOOK_MUA && MIME_HTML_ONLY)
 152 describe FORGED_OUTLOOK_HTML    Outlook can't send HTML message only
 153
 154 # bug 2525: FORGED_IMS_HTML fp'ing because new IMS *DOES* use text/html
 155 # ctype.  ARGH.  This was noted in build 5.5.2656.59, so permit builds
 156 # after that to get away with it.
 157 header __IMS_HTML_BUILDS        X-Mailer =~ /^Internet Mail Service .(?:[6789]\.|5\.[6789]|5\.5\.(?:[3456789]|2[789]|26[6789]|265[6789]))/
 158 header __IMS_HTML_RCVD          Received =~ /\bby \S+ with Internet Mail Service .(?:[6789]\.|5\.[6789]|5\.5\.(?:[3456789]|2[789]|26[6789]|265[6789]))/
 159 meta FORGED_IMS_HTML            (!__YAHOO_BULK && __IMS_MUA && MIME_HTML_ONLY && !(__IMS_HTML_BUILDS && __IMS_HTML_RCVD))
 160 describe FORGED_IMS_HTML        IMS can't send HTML message only
 161
 162 meta FORGED_THEBAT_HTML         (__THEBAT_MUA_V1 && MIME_HTML_ONLY)
 163 describe FORGED_THEBAT_HTML     The Bat! can't send HTML message only
 164
 165 # bug 2513
 166 header __REPTO_QUOTE            Reply-To =~ /".*"\s*\</
 167 meta REPTO_QUOTE_AOL            __REPTO_QUOTE && __AOL_MUA
 168 describe REPTO_QUOTE_AOL        AOL doesn't do quoting like this
 169
 170 meta REPTO_QUOTE_IMS            __REPTO_QUOTE && __IMS_MUA
 171 describe REPTO_QUOTE_IMS        IMS doesn't do quoting like this
 172
 173 meta REPTO_QUOTE_MSN            __REPTO_QUOTE && (__FROM_MSN_COM || __AT_MSN_MSGID)
 174 describe REPTO_QUOTE_MSN        MSN doesn't do quoting like this
 175
 176 meta REPTO_QUOTE_QUALCOMM       __REPTO_QUOTE && __ANY_QUALCOMM_MUA
 177 describe REPTO_QUOTE_QUALCOMM   Qualcomm/Eudora doesn't do quoting like this
 178
 179 meta REPTO_QUOTE_YAHOO          __REPTO_QUOTE && (__FROM_YAHOO_COM || __AT_YAHOO_MSGID)
 180 describe REPTO_QUOTE_YAHOO      Yahoo! doesn't do quoting like this
 181
 182 # bug 1561
 183 # stronger version of USER_AGENT_APPLEMAIL
 184 # Apple Mail doesn't send text/html at all (unless it's an attachment)
 185 # It'll send text/plain, or multipart/alternative with text/plain and
 186 # text/enriched parts (boundary of "Apple-Mail-\d--\d+").  It can, however,
 187 # send a multipart/mixed with a single text/html attachment, so don't use
 188 # MIME_HTML_ONLY.
 189 # perhaps limit CTYPE to "text/plain", "multipart/alternative" with
 190 # "text/plain" and "text/enhanced", or "multipart/mixed"?
 191 # bug 4223: expand for new Apple Mail version format
 192 header __X_MAILER_APPLEMAIL     X-Mailer =~ /^Apple Mail \(\d\.\d+(?:\.\d+)?\)$/
 193 header __MSGID_APPLEMAIL        Message-Id =~ /^<[0-9A-F]{8}-(?:[0-9A-F]{4}-){3}[0-9A-F]{12}\@\S+>$/
 194 header __MIME_VERSION_APPLEMAIL Mime-Version =~ /^1\.0 \(Apple Message framework v\d+(?:\.\d+)?\)$/
 195 meta __USER_AGENT_APPLEMAIL     !__CTYPE_HTML && __X_MAILER_APPLEMAIL && (__MSGID_APPLEMAIL || __MIME_VERSION_APPLEMAIL)
 196
 197 # 2003-02-23: quinlan
 198 # some useful meta rule sub-elements
 199 header __CTYPE_HTML             Content-Type =~ /text\/html/i
 200 header __ANY_IMS_MUA            X-Mailer =~ /^Internet Mail Service\b/
 201 header __ANY_OUTLOOK_MUA        X-Mailer =~ /^Microsoft (?:Office )?Outlook\b/
 202
 203 header __ANY_QUALCOMM_MUA       X-Mailer =~ /\bQUALCOMM\b/
 204 meta FORGED_QUALCOMM_TAGS       (__ANY_QUALCOMM_MUA && __MIME_HTML && !__TAG_EXISTS_HTML)
 205 describe FORGED_QUALCOMM_TAGS   QUALCOMM mailers can't send HTML in this format
 206
 207 meta FORGED_IMS_TAGS            (!__YAHOO_BULK && __ANY_IMS_MUA && __MIME_HTML && !(__TAG_EXISTS_HTML && __TAG_EXISTS_HEAD && __TAG_EXISTS_META && __TAG_EXISTS_BODY))
 208 describe FORGED_IMS_TAGS        IMS mailers can't send HTML in this format
 209
 210 meta FORGED_OUTLOOK_TAGS        (!__YAHOO_BULK && __ANY_OUTLOOK_MUA && __MIME_HTML && !(__TAG_EXISTS_HTML && __TAG_EXISTS_HEAD && __TAG_EXISTS_META && __TAG_EXISTS_BODY))
 211 describe FORGED_OUTLOOK_TAGS    Outlook can't send HTML in this format
 212
 213 # Send-Safe ratware (idea from Alan Curry)
 214 # random alphanumerics, separated into groups of 16 by dashes (the first
 215 # and last group may be shorter), with a lowercase "l" and a number
 216 # appended. The final number is the length of the whole string not
 217 # including the dashes or the "l<number>".  Why? I have no idea.  It's
 218 # not a tracking code - the spamware does not save it locally.
 219 #
 220 # jm: it's specifically to throw off MIME base64 encoding, to evade AOL's
 221 # filters.
 222 #
 223 # http://groups.google.com/groups?selm=atp1ip0n22%40enews3.newsguy.com
 224 rawbody RATWARE_HASH_DASH       /[a-z\d]-[a-z\d]{16}-[a-z\d]{1,16}(?-i:l)\d/i
 225 describe RATWARE_HASH_DASH      Contains a hashbuster in Send-Safe format
 226
 227 ########################################################################
 228 # Most ratware uses message templates I would guess.
 229 # Here's two popular ones...
 230
 231 ########################################################################
 232 # This ratware always uses a +0000 TZ in the Date header, and has a multiplicity
 233 # of From: header formats. ("From" header samples from Steven Champeon
 234 # <schampeo.hesketh.com> via the spamtools.lists.abuse.net and SPAM-L lists).
 235 #
 236 # "First Last" <firstlast_[a-z][a-z]@somedomain>        1
 237 # "First Last" <firstlast[a-z][a-z]@somedomain>         1
 238 # "First Last" <first.last[a-z][a-z]@somedomain>        1
 239 # "First Last" <first_last[a-z][a-z]@somedomain>        1
 240 # "First Last" <first_last_[a-z][a-z]@somedomain>       1
 241 # "First Last" <flast_[a-z][a-z]@somedomain>            2
 242 # "First Last" <flast[a-z][a-z]@somedomain>             2
 243 # "First Last" <f.last_[a-z][a-z]@somedomain>           2
 244 # "First Last" <f.last[a-z][a-z]@somedomain>            2
 245 # "First Last" <f_last[a-z][a-z]@somedomain>            2
 246 # "First Last" <last[a-z][a-z]@somedomain>              3
 247 # "First M. Last" <firstlast_[a-z][a-z]@somedomain>     4
 248 # "First M. Last" <firstlast[a-z][a-z]@somedomain>      4
 249 # "First M. Last" <first.m.last[a-z][a-z]@somedomain>   5
 250 # "First M. Last" <firstmlast[a-z][a-z]@somedomain>     5
 251 # "First M. Last" <firstmlast_[a-z][a-z]@somedomain>    5
 252 # "First M. Last" <fmlast_[a-z][a-z]@somedomain>        6
 253 # "First M. Last" <mlast[a-z][a-z]@somedomain>          7
 254 # "First M. Last" <m.last[a-z][a-z]@somedomain>         7
 255 header __0_TZ_1      From =~ /^\"(\w)(\w+) (\w+)\" <\1\2[\._]?\3_?[a-z][a-z]\@/i
 256 header __0_TZ_2      From =~ /^\"(\w)(\w+) (\w+)\" <\1[\._]?\3_?[a-z][a-z]\@/i
 257 header __0_TZ_3      From =~ /^\"(\w)(\w+) (\w+)\" <\3_?[a-z][a-z]\@/i
 258 header __0_TZ_4      From =~ /^\"(\w)(\w+) (\w)\. (\w+)\" <\1\2[\._]?\4_?[a-z][a-z]\@/i
 259 header __0_TZ_5      From =~ /^\"(\w)(\w+) (\w)\. (\w+)\" <\1\2[\._]?\3[\._]?\4_?[a-z][a-z]\@/i
 260 header __0_TZ_6      From =~ /^\"(\w)(\w+) (\w)\. (\w+)\" <\1\3\4_?[a-z][a-z]\@/i
 261 header __0_TZ_7      From =~ /^\"(\w)(\w+) (\w)\. (\w+)\" <\3[\._]?\4_?[a-z][a-z]\@/i
 262
 263 header __RATWARE_0_TZ_DATE      Date =~ / \+0000$/
 264
 265 meta RATWARE_ZERO_TZ            (__RATWARE_0_TZ_DATE && __CTYPE_HTML && (__0_TZ_1 || __0_TZ_2 || __0_TZ_3 || __0_TZ_4 || __0_TZ_5 || __0_TZ_6 || __0_TZ_7))
 266 describe RATWARE_ZERO_TZ        Bulk email fingerprint (+0000) found
 267
 268
 269 header X_MESSAGE_INFO           exists:X-Message-Info
 270 describe X_MESSAGE_INFO         Bulk email fingerprint (X-Message-Info) found
 271
 272 # case-sensitive rule
 273 # only significant rules with no FPs, hit recently, on 2+ corpuses
 274 header HEADER_SPAM              ALL =~ /^(Alternate-Recipient|Antivirus|Approved|Delivery-Notification|Disclose-Recipients|Error-path|Language|Location|Mime-Subversion|Newsletter-ID|PID|Rot|UID|X-BounceTrace|X-CS-IP|X-Company-Address|X-Company-City|X-Company-Country|X-Company-State|X-Company-Zip|X-E(?:[Mm]ail)?|X-Encoding|X-Originating-Company|X-RMD-Text|X-SG4|X-SP-Track-ID|X-Webmail-Time|X-bounce-to):/m
 275 describe HEADER_SPAM            Bulk email fingerprint (header-based) found
 276
 277 header RATWARE_RCVD_PF          Received =~ / \(Postfix\) with ESMTP id [^;]+\; \S+ \d+ \S+ \d+ \d+:\d+:\d+ \S+$/s
 278 describe RATWARE_RCVD_PF        Bulk email fingerprint (Received PF) found
 279
 280 header RATWARE_RCVD_AT          Received =~ / by \S+\@\S+ with Microsoft SMTPSVC/
 281 describe RATWARE_RCVD_AT        Bulk email fingerprint (Received @) found
 282
 283 header __RCVD_WITH_EXCHANGE     Received =~ /with Microsoft Exchange Server/
 284
 285 meta RATWARE_OUTLOOK_NONAME     __MSGID_DOLLARS_OK && !__HAS_X_MAILER && !__RCVD_WITH_EXCHANGE
 286 describe RATWARE_OUTLOOK_NONAME Bulk email fingerprint (Outlook no name) found
 287
 288
 289
 290 header __MIMEOLE_MS             X-MIMEOLE =~ /^Produced By Microsoft MimeOLE/
 291 meta RATWARE_MS_HASH            __MSGID_DOLLARS_OK && !__MIMEOLE_MS && !__RCVD_WITH_EXCHANGE
 292 describe RATWARE_MS_HASH        Bulk email fingerprint (msgid ms hash) found
 293
 294 ###########################################################################
 295
 296 ifplugin Mail::SpamAssassin::Plugin::HeaderEval
 297
 298 header __GATED_THROUGH_RCVD_REMOVER  eval:gated_through_received_hdr_remover()
 299
 300 header __RATWARE_NAME_ID        eval:check_ratware_name_id()
 301 meta RATWARE_NAME_ID            __RATWARE_0_TZ_DATE && __RATWARE_NAME_ID
 302 describe RATWARE_NAME_ID        Bulk email fingerprint (msgid from) found
 303
 304 header RATWARE_EFROM            eval:check_ratware_envelope_from()
 305 describe RATWARE_EFROM          Bulk email fingerprint (envfrom) found
 306
 307 endif
 308
 309 ###########################################################################
 310
 311 ifplugin Mail::SpamAssassin::Plugin::MIMEEval
 312
 313 body __MIME_HTML                eval:check_for_mime_html()
 314
 315 endif
 316
 317 ###########################################################################
 318
 319 ifplugin Mail::SpamAssassin::Plugin::HTMLEval
 320
 321 body __TAG_EXISTS_BODY          eval:html_tag_exists('body')
 322 body __TAG_EXISTS_HEAD          eval:html_tag_exists('head')
 323 body __TAG_EXISTS_HTML          eval:html_tag_exists('html')
 324 body __TAG_EXISTS_META          eval:html_tag_exists('meta')
 325 body __TAG_EXISTS_STYLE         eval:html_tag_exists('style')
 326 body __TAG_EXISTS_SCRIPT        eval:html_tag_exists('script')
 327
 328 endif