[Rspamd-Users] BASE64 Encoding in FROM

[Wiethoff, Helge]

Hi,

thanks for taking a look into this!

Vsevolod Stakhov <vsevolod at rspamd.com>:
> That is really quite surprising. Now I have no traces why was it
> considered invalid as well :(
Oha. Me neither (-:

Found your reverted commit here: 
https://github.com/rspamd/rspamd/commit/a4255c642865592ed07c79113d78c86d1650d27c

Should i create an issue about this?


Thanks again
Helge




> On 13/11/2018 15:13, Wiethoff, Helge wrote:
> > Hello everyone,
> >
> > I'm seeing a lot of spam where the from field is BASE64 encoded:
> > From: =?UTF-8?B?TXVzdGVyLCBNYXggPG1heC5tdXN0ZXJAZXhhbXBsZS5jb20+?=
> <max.muster at example.com>
> >
> > The decoded BASE64 string is an email address (including angle brackets).
> Unfortunately rspamd does not recognize the doubled FROM. Has anyone an idea
> how to filter those multiple froms?
> >
> >
> > Thanks
> > Helge
> >
> > PS: Sorry for the "double post" -- I was asking this already in the chat
> but my client died right after asking...
> >
> >
> >
>
> This is very weird indeed. I have fixed that in the commit
>
> 352a465639b64e024e54e25b76d59e4e68b798b5
>
> and then reverted it back with the following trace in IRC:
>
> 19:00 < rspamd-commits> [rspamd] vstakhov pushed 1 new commit to master:
> https://git.io/vNixM
> 19:00 < rspamd-commits> rspamd/master a4255c6 Vsevolod Stakhov: Revert
> "[Fix] Use decoded values when parsing mime addresses"...
> 19:01 <@cebka> hum
> 19:01 <@cebka> this commit seems invalid
> 19:01 <@cebka> and I cannot find any traces why have I done it :(
>
> That is really quite surprising. Now I have no traces why was it
> considered invalid as well :(
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 7735 bytes
Desc: not available
URL: <https://lists.rspamd.com/pipermail/users/attachments/20181113/397f18bb/attachment.bin>