Yet the following spam message was delivered to my catchall:Criteria:
Where the subject line contains specific words (Enabled)
Word List: big5
Actions:
Delete Message (Enabled)
So I ran a test. I created another filter for any message containing the word "BLeEB" in the subject.Received: from dale_web_1 ([216.216.134.153]) by anti-spam.org with MailEnable ESMTP; Sat, 02 Oct 2004 12:44:38 -0400
Received: from dodliws ([61.31.128.40]) by dale_web_1 with Microsoft SMTPSVC(6.0.3790.0);
Sat, 2 Oct 2004 12:48:04 -0400
From: =?Big5?B?qLO9R652?= <nMHak@msa.hinet.net>
To: "undisclosed-recipients" {address deleted for privacy}
Subject: =?Big5?B?t1G9Ry4uLr7jpNG3Uaazpc623D8/?=
Date: Sun, 3 Oct 2004 00:49:41 +0800
Content-Type: text/html;
charset="big5"
Content-Transfer-Encoding: 8bit
Sender: =?big5?B?qLO9R652?= <nMHak@msa.hinet.net>
Reply-To: ebJrb@mailfb.com
X-MimeOLE:Produced By Mircosoft MimeOLE V6.00.2600.0000
Return-Path:RpveF@mailfb.com
Message-ID: <DALE_WEB_1MaF6D0kve0008a58b@dale_web_1>
X-OriginalArrivalTime: 02 Oct 2004 16:48:05.0208 (UTC) FILETIME=[96898D80:01C4A89F]
Received-SPF: none (anti-spam.org: msa.hinet.net does not designate permitted sender hosts)
X-RCPT-TO: {address deleted for privacy},{address deleted for privacy}
{message body deleted}
I sent messages with the subjects:
The three bold-faced ones were deleted, but only two deletions showed up in the filter log while the MTA log showed all three:bleeb
BLeEB
aBLeEB?
Enlarge your bleeb!
Make your bleeb larger!
Filter Log:
MTA Activity Log:Time Action MessageID Connector Filter Result Account Sender
10/02/04 13:29:35 Start - - - - - -
10/02/04 13:29:43 Executed CF8D732CD864478AB1EB5F9CC059D.MAI SMTP Subject contains BLeEB DELETE anti-spam.org {address deleted for privacy} 10.0.0.10
10/02/04 13:34:43 Executed 8FC6ED924F5847338867EC216B6163.MAI SMTP Subject contains BLeEB DELETE anti-spam.org {address deleted for privacy} 10.0.0.10
Conclusions:10/02/04 13:29:32 [50061FD4ADF64B4698A8862E5CA4.MAI] from (SMTP) [SMTP:{address/mailbox deleted for privacy}] Mapped Literal
10/02/04 13:29:35 [50061FD4ADF64B4698A8862E5CA4.MAI]:[SMTP] (Subject contains BLeEB DELETE)
10/02/04 13:29:40 [CF8D732CD864478AB1EB5F9CC059D.MAI] from (SMTP) [SMTP:{address/mailbox deleted for privacy}] Mapped Literal
10/02/04 13:29:43 [CF8D732CD864478AB1EB5F9CC059D.MAI]:[SMTP] (Subject contains BLeEB DELETE)
10/02/04 13:30:08 [F33371961A8648049E31FF82968D7C.MAI] from (SMTP) [SMTP:{address/mailbox deleted for privacy}] Mapped Literal
10/02/04 13:33:54 [9B0755B24C87407FAA63A3C1DFB771.MAI] from (SMTP) [SMTP:{address/mailbox deleted for privacy}] Mapped Literal
10/02/04 13:34:41 [8FC6ED924F5847338867EC216B6163.MAI] from (SMTP) [SMTP:{address/mailbox deleted for privacy}] Mapped Literal
10/02/04 13:34:43 [8FC6ED924F5847338867EC216B6163.MAI]:[SMTP] (Subject contains BLeEB DELETE)
1. The filtering is not case sensitive [good!]
2. The first filter applied causes the daily MTA filtering log to be created but does not record the filter's action [bad!]
3. The filtering has defined "words" as having some kind of delimitation which is not documented [very bad!].
Further testing reveals that words are not recognized if they have certain punctuation after them (commas, periods, question marks, exclamation points). They are recognized if they are between quotes.
So, if you filter on the word "bleeb" in the subject, all of the follow messages will get past the filter:
You can have a 9-inch bleeb!
Men all over the world have larger bleebs because of our product.
Enlarge your bleeb.
Do you want a larger bleeb?
I recommend that "words" be changed to "strings" for flexibility, usefulness, and to reduce confusion. By strings, I mean that the ME matches the user string without testing for spaces, punctuation, or other delimiters unless included by the user. If I create the string "tick", then it should match on " tick ", " ticks ", " stick ", and " sticks ".