RE: [Exim] Generic VBS script detection

Top Page
Delete this message
Reply to this message
Author: Ian Edwards
Date:  
To: EXIM users
Subject: RE: [Exim] Generic VBS script detection
On 04-May-00 Nigel Metheringham wrote:
> I am not a filter expert :-(, and have not tested this, but how about
> something like this as a starting point:-
>
>   if ($message_body matches "^\\s+name=[A-Za-z0-9_-.]+.[vV][bB][sS]" or
>       $message_body matches "^begin \\d\\d\\d .+\\.[vV][bB][sS]")
>       ... then/action/endif


Some points
1) 'matches' ignores case so you can use 'vbs' and not '[vV][bB][sS]'.
2) Does the beginning of line anchor work ? The doc on Exim filters
says (about $message_body) "Newlines are converted into spaces..."

I was thinking about

if $message_body matches \
Content-Type:\\s*application/octet-stream\\s*;\\s*name=".*\\.vbs"\\s
then
    ...


to restrict it to attachments that should get executed. But does Outlook
ignore the Content-Type: and just go by the ".vbs" extension ?

Ian.



 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
  E-mail: Ian Edwards <ian@???>
  Date:   05-May-00             Time:   02:17:09


  Early Music Record Labels    - http://www.recordlabels.org/
  'ups' debugger for C/C++/f77 - http://www.concerto.demon.co.uk/UPS/
 -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-