Re: [exim] URL in content mail

On Wed, Dec 12, 2018 at 1:25 PM Sławomir Dworaczek via Exim-users <
exim-users@???> wrote:

> I have always used clamav but he unfortunately does not recognize viruses
> by url. Appointments yes, I can do it


With SpamAssassin ("SA" hereafter), make your own rule to e.g.
local_url_rules.cf, something like this, test and adapt as necessary:

uri __LOCAL_URI_EMAIL_IN_GET_REQUEST /\?email=[^\@]+\@[^\@]+$/

Then you can combine this in another SA meta rule, e.g. like this:

header __FROM_DOT_ORG From =~ /\@[^@]+\.org>?$/
header __FROM_DOT_NET From =~ /\@[^@]+\.net>?$/
header __FROM_DOT_US From =~ /\@[^@]+\.us>?$/


meta LOCAL_CONTENT_POLICY_001 __LOCAL_URI_EMAIL_IN_GET_REQUEST &&
(__FROM_DOT_ORG || __FROM_DOT_NET || __FROM_DOT_US)
describe LOCAL_CONTENT_POLICY_001 Local content policy
score LOCAL_CONTENT_POLICY_001 0.1

Set the score to something more than 0.1 when you are satisfied that there
are few enough false positives and enough true positives.
--
Jan