[Rspamd-Users] block foreign charsets

[Vsevolod Stakhov]

On 16/05/2023 10:56, Achim Lammerts via Users wrote:
> Hey,
> I do this with a map configured in …
> 
> # /etc/rspamd/local.d/multimap.conf:
> BAD_CONTENT {
>      type = "content";
>      filter = "headers";
>      map = "${LOCAL_CONFDIR}/local.d/content_bad.map";
>      description = "Blocked header content map";
>      symbol = "BAD_CONTENT";
>      score = 10.0;
>      regexp = true;
>      }
> 
> an i. e. …
> 
> # /etc/rspamd/local.d/content_bad.map:
> 
> /Content-Type:.*(koi8\-r|big5|euc\-kr|gb2312|ksc5601\-1987|iso\-2022\-jp|windows\-1251).*/ 
> 
> 
> Regards
> Achim
> 
> Am 16.05.23 um 09:29 schrieb Katharina Knuth via Users:
>> Hello, how can I block foreign charsets in rspamd?
>> Like
>>
>> /Content-Type:.charset\s=\s*\“(koi8-r|big5|euc-kr|gb2312|ksc5601-1987|iso-2022-jp|windows-1251)\“/ 
>>
>>
>> I do this at present with pcre via Postfix main.cf
>>
>> mimeheaderchecks =
>>      pcre:$filter/mimeheaderchecks
>>
>>

This is not a correct advice I'm afraid.

The proper way is suggested in the documentation: 
https://rspamd.com/doc/lua/examples.html#languages-filter

Furthermore, if you want to filter headers, it is way better to use a 
specific header, such as `Content-Type` as `headers` filter will not 
catch the content of the mime parts headers (for example, in multipart 
containers). I'm not even touching the performance aspects here, but 
this rule will have very poor performance and will have huge false 
positive rate.

Postmaster hat on: please refrain from top posting in this mailing list, 
thanks.