----- Original Message -----
Sent: Wednesday, May 30, 2001 8:28 PM
Subject: [Exim] filtering on email attachments
> Unfortunately the powers that be only want documents that contain macros
> to be quarantined rather than every document and I have no idea how to do
> this! I realise that the attachments will need to be decoded and then
passed
> to <some program> to check for the presence of macros, so far I have been
> unable to locate such a program.... If it can be done within Perl then
that
> will be fine as I can then do the entire filter in perl.
Is the reason he doesn't want macros is because of viruses then install
amavis (
www.amavis.org )
if he wants copies of all documents with a macro in it then u could create a
pipe transport that passes it to perl, which scans for the tell tale part of
a doc that is a macro (just dump the same file with a macro and without a
macro and run diff over it)
the perl would just see if it had that pattern and deceided to save it or
mail it on.
you could use the system filter doing the same thing I guess and freezing it
(using the virus scanning template and have doc or xls as the extentions
being tested saving it from applying the regex to every email, but you would
have to change the size of the amount of email passed to the system filter
which would degrade performance.
HTH
cya
Andrew
--
The problem with fools is that they are so ingenious.
