Bug 1525 - USERNAME_IN_SUBJECT does not fire
Summary: USERNAME_IN_SUBJECT does not fire
Status: RESOLVED WORKSFORME
Alias: None
Product: Spamassassin
Classification: Unclassified
Component: spamc/spamd (show other bugs)
Version: 2.50
Hardware: Other Linux
: P5 normal
Target Milestone: 2.60
Assignee: SpamAssassin Developer Mailing List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2003-02-22 12:59 UTC by Greg
Modified: 2003-02-23 11:10 UTC (History)
0 users


Attachment Type Modified Status Actions Submitter/CLA Status
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Greg 2003-02-22 12:59:36 UTC 
In testing the release version of SA 2.50 it appears the USERNAME_IN_SUBJECT 
does not fire or give an indication in the tests= section of the SA header of 
the email.  I sent myself an email from one of my hotmail accounts to my email 
address gcirino@cirelle.com and put gcirino as the first word in the subject 
with a message body of test.

The reason I am testing this is due to an increasing amount of spam I am seeing 
with either my username or full email address in the subject (at the begining, 
in the middle and at the end of the subject).  This is always junk mail.

The header and describe for the rule are in 20_head... file and there is a 
appropriate score in the 50_scores.... file.

This makes me wonder if other rules are not firing as well.

I submitted this to the list but it may not be at the top of anybody's priority 
list.

Regards
Greg Cirino
Comment 1 Greg 2003-02-22 13:05:14 UTC 
Using Linux 7.3
Perl 5.6.1
Comment 2 Theo Van Dinter 2003-02-22 13:29:21 UTC 
It works fine for me.  Can you attach a sample message that shows the problem?

Also, the RE for this rule requires the username, followed by a comma, followed by a non-whitespace character.  So "Subject: username hi!" and "Subject: username, hi!" don't hit, but "Subject: username,hi!" does hit.  The RE is very conservative due to the number of FPs we found when testing different REs.
Comment 3 Greg 2003-02-22 13:59:07 UTC 
Subject: Re:  USERNAME_IN_SUBJECT does not fire

| ------- Additional Comments From felicity@kluge.net  2003-02-22 13:29 -------
| It works fine for me.  Can you attach a sample message that shows the problem?


Return-Path: <patcirino222@hotmail.com>
Delivered-To: gcirino@cirelle.com
>From patcirino222@hotmail.com Sat Feb 22 22:21:36 2003
Return-Path: <patcirino222@hotmail.com>
Delivered-To: cirelle.com-gcirino@cirelle.com
Received: (qmail 1793 invoked from network); 22 Feb 2003 22:21:36 -0000
Received: from localhost (HELO relent.cedata.com) (127.0.0.1)
  by relent.cedata.com with SMTP; 22 Feb 2003 22:21:36 -0000
X-MessageWall-Score: 1 (relent.cedata.com)
X-MessageWall-Warning: DNSBL-DOMAIN/REJECT: postmaster.rfc-ignorant.org/hotmail.com: Your domain is listed by a DNS-based blacklist.  Please see http://rfc-ignorant.org/
Received: from [216.33.240.141] by relent.cedata.com (MessageWall 1.1.0) with SMTP; 22 Feb 2003 22:21:36 -0000
Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC;
  Sat, 22 Feb 2003 13:57:18 -0800
Received: from 65.167.180.250 by lw8fd.law8.hotmail.msn.com with HTTP;
 Sat, 22 Feb 2003 21:57:17 GMT
X-Originating-IP: [65.167.180.250]
From: "pat cirino" <patcirino222@hotmail.com>
To: gcirino@cirelle.com
Bcc: 
Subject: gcirino hi
Date: Sat, 22 Feb 2003 21:57:17 +0000
Mime-Version: 1.0
Content-Type: text/plain; format=flowed
Message-ID: <F26651JJTKkdNI992C4000180f2@hotmail.com>
X-OriginalArrivalTime: 22 Feb 2003 21:57:18.0124 (UTC) FILETIME=[5E0ADEC0:01C2DABD]
X-Spam-Status: No, hits=1.7 required=7.9
 tests=FROM_ENDS_IN_NUMS,MESSAGEWALL_SCORE_1
 version=2.50-ce1.0
X-Spam-Level: *
X-Spam-Checker-Version: SpamAssassin 2.50-ce1.0 (1.173-2003-02-20-exp)
X-DCC-XactSystems-Metrics: relent.cedata.com 1083; Body=1 Fuz1=1





testing

_________________________________________________________________
The new MSN 8: smart spam protection and 2 months FREE*  
http://join.msn.com/?page=features/junkmail

----- Original Message ----- 
From: <bugzilla-daemon@hughes-family.org>
To: <gcirino@cirelle.com>
Sent: Saturday, February 22, 2003 4:29 PM
Subject: [Bug 1525] USERNAME_IN_SUBJECT does not fire


| http://www.hughes-family.org/bugzilla/show_bug.cgi?id=1525
| 
| 
| 
| 
| 
| ------- Additional Comments From felicity@kluge.net  2003-02-22 13:29 -------
| It works fine for me.  Can you attach a sample message that shows the problem?
| 
| Also, the RE for this rule requires the username, followed by a comma, followed by a non-whitespace character.  So "Subject: username hi!" and "Subject: username, hi!" don't hit, but "Subject: username,hi!" does hit.  The RE is very conservative due to the number of FPs we found when testing different REs.
| 
| 
| 
| ------- You are receiving this mail because: -------
| You reported the bug, or are watching the reporter.
Comment 4 Theo Van Dinter 2003-02-22 14:04:43 UTC 
Yup.  Per my last post, that's not a subject that will hit.  Not only 
is there no comma, there's a whitespace char.
Comment 5 Greg 2003-02-22 14:39:18 UTC 
Subject: Re:  USERNAME_IN_SUBJECT does not fire

Just an FYI, the spam I am seeing has the following,

username some text
username, some text
Username, some text
some text username
some text full_email_address

I guess I mis-understood the rule.

Thanks for your time.

Regards,
Greg

----- Original Message ----- 
From: <bugzilla-daemon@hughes-family.org>
To: <gcirino@cirelle.com>
Sent: Saturday, February 22, 2003 5:04 PM
Subject: [Bug 1525] USERNAME_IN_SUBJECT does not fire


| http://www.hughes-family.org/bugzilla/show_bug.cgi?id=1525
| 
| felicity@kluge.net changed:
| 
|            What    |Removed                     |Added
| ----------------------------------------------------------------------------
|              Status|NEW                         |RESOLVED
|          Resolution|                            |WORKSFORME
| 
| 
| 
| ------- Additional Comments From felicity@kluge.net  2003-02-22 14:04 -------
| Yup.  Per my last post, that's not a subject that will hit.  Not only 
| is there no comma, there's a whitespace char.
| 
| 
| 
| ------- You are receiving this mail because: -------
| You reported the bug, or are watching the reporter.
Comment 6 Daniel Quinlan 2003-02-23 20:10:26 UTC 
Just to offer a bit more explanation about why the rule works the way it does.

Some things that are very common in spam are unfortunately common enough
in ham that we can't use them as tests.  Some forms of putting the username
in the Subject fall into that category.