[Rspamd-Users] [ext] Re: Block File by type or extantion

[Ralf Hildebrandt]

* Tim Harman via Users <users at lists.rspamd.com>:
> On 11/12/2018 8:51 am, Koby Peleg Hen wrote:
> 
> > This is file name not file type. 
> > I am looking for block by file type like mailscanner.
> 
> Please don't top-reply on this list. 
> 
> You can block by extension, which is basically filetype.  Of course it's
> possible to rename a zip to pdf etc to bypass this. 

And that's what trojans and viruses do nowadays!

> Are you saying that mailscanner performs heuristics on the file to
> determine it's type, ignoring whatever extn it has? 

Like amavisd-new does.

> rspamd doesn't do this and while I can't actually speak for the author,
> I doubt it ever will.  I think it would slow down processing too much.

'file' reads the first 64 Bytes of the file to find it's type. How
lang could that take?

-- 
Ralf Hildebrandt                   Charite Universitätsmedizin Berlin
ralf.hildebrandt at charite.de        Campus Benjamin Franklin
https://www.charite.de             Hindenburgdamm 30, 12203 Berlin
Geschäftsbereich IT, Abt. Netzwerk fon: +49-30-450.570.155