Bruce Richardson wrote:
>
> On Wed, Mar 31, 2004 at 10:00:40AM -0500, Dean Brooks wrote:
> > On Wed, Mar 31, 2004 at 09:58:09AM -0500, Dickenson, Steven wrote:
> >
> > > The demime function is still alive and well in -16. I'm using it
> > > here for simplicities sake. I have no immediate need to do any kind
> > > of lower-level MIME scanning, nor am I really sure what I should and
> > > should not be checking with it. Thus, demime = BLOCKED_FILENAMES
> > > works just fine for me!
>
> > Problem is, from my understanding, the demime function has to unpack
> > all the attachments into the scan temporary directory, which can be
> > pretty IO intensive on a high-volume server.
>
> And the demime function doesn't take wildcards or regexes, so you can't
> use it block attachments with CLSID extensions, for example. The MIME
> acl will let you do that.
>
No, but this does work (watch for wrap in the regex).
deny message = CLSID found
regex = \
^(?i)Content-Disposition::(.*?)filename=\\s*"+((\{[a-hA-H0-9-]{25,}\})|((.
*?)\\s{10,}(.*?)))"+\$
--
--EAL--
