[Rspamd-Users] weird MIME penalisation on (IMO) right formated mail attachments - RSPAMD or our mistake?

[Franta Hanzlík]

On Tue, 15 Apr 2025 16:06:49 +0100 (BST)
"G.W. Haywood" <rspamd at jubileegroup.co.uk> wrote:

> Hi there,
> 
> On Tue, 15 Apr 2025, Franta Hanzlík wrote:
> > On Tue, 15 Apr 2025 "G.W. Haywood" wrote:  
> >> On Tue, 15 Apr 2025, Franta Hanzlík wrote:  
>  [...]  
>  [...]  
>  [...]  
> >> ...
> >> Can you not whitelist the mail which you do not wish rspamd to filter?
> >> ...  
> > ...
> > ... I would probably be able to write some ?selector? map to whitelist
> > emails from our domain to our domain - but if it were possible to make
> > it more precise/refined to whitelist only specific types of attachments
> > or to nullify the effect of penalizing some symbols (MIME_BAD_EXTENSION,
> > MIME_BAD_ATTACHMENT, MIME_BASE64_TEXT, R_MIXED_CHARSET,...), that would
> > be even better.
> > ...  
> 
> Take a look at
> 
> https://rspamd.com/doc/modules/mime_types.html
> 
> (especially the last paragraph) and also at
> 
> https://rspamd.com/doc/configuration/settings.html
> 
> I think that should help you.
> -- 

Hello Ged, thanks for the push in the right direction.
At end, it seems that correct recognition of all MIME types of .js 
(javascript) attached files can be set by writing something like this 
in /etc/rspamd/local.d/mime_types.conf :

extension_map = {
# RSPAMD nezna spravny MIME typ pro .js (text/javascript), takze .js prilohy tvrde penalizuje v MIME_BAD_ATTACHMENT (=="Invalid attachment mime type"). Tohle legalizuje vsechny /i stare/ MIME typy pro .js:
  js = [
    "text/javascript",
    "application/javascript",
    "application/ecmascript",
    "application/x-javascript"
    "application/x-ecmascript"
    "text/ecmascript",
    "text/jscript",
    "text/livescript",
    "text/x-javascript",
    "text/x-ecmascript",
    "text/javascript1.0",
    "text/javascript1.1",
    "text/javascript1.2",
    "text/javascript1.3",
    "text/javascript1.4",
    "text/javascript1.5"
  ]
}

#-----------------

Another option is probably to set a own penalty for my specific MIME 
type in file "/etc/rspamd/local.d/maps.d/mime_types.inc.local" (is 
included from /etc/rspamd/modules.d/mime_types.conf) : 

text/javascript 0

#------------------

And is also possible for regexp matched attachment file names bypass
mime test by whitelist map in /etc/rspamd/local.d/mime_types.conf as:

filename_whitelist = "/etc/rspamd/local.d/maps.d/mime_types.wl" 

and in /etc/rspamd/local.d/maps.d/mime_types.wl :

/\.js$/


(assuming that LOCAL_CONFDIR="/etc/rspamd/local.d")

-- 
Franta Hanzlík