Bug 2914 - False positives on OBFUSCATING_COMMENT
Summary: False positives on OBFUSCATING_COMMENT
Status: RESOLVED DUPLICATE of bug 1527
Alias: None
Product: Spamassassin
Classification: Unclassified
Component: Rules (show other bugs)
Version: 2.61
Hardware: All Linux
: P5 normal
Target Milestone: 2.70
Assignee: SpamAssassin Developer Mailing List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2004-01-09 07:48 UTC by Nick Leverton
Modified: 2004-01-24 02:13 UTC (History)
0 users


Attachment Type Modified Status Actions Submitter/CLA Status
Example of FP for OBFUSCATING_COMMENT text/plain None Nick Leverton [HasCLA]
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Nick Leverton 2004-01-09 07:48:58 UTC 
Considering the high score of 4.2 for OBFUSCATING_COMMENT, it's quite 
important that it not FP.  I've found a case where it does (attachment coming 
shortly).  The mail was generated at an online greetings card site, and the 
HTML code contains some innocuous comments, yet the above rule was tripped.
Comment 1 Nick Leverton 2004-01-09 07:56:35 UTC 
Created attachment 1671 [details]
Example of FP for OBFUSCATING_COMMENT

Sorry for size of attachment - for some reason, this does not trigger if I
remove the GIF.
Comment 2 Fred T 2004-01-09 08:56:37 UTC 
This is the bug I've been dealing with where the file attachment is treated as 
part of the message and the base64 code of the file is probably causing the 
rule to trigger.
Comment 3 Theo Van Dinter 2004-01-09 12:51:44 UTC 
Subject: Re:  False positives on OBFUSCATING_COMMENT

On Fri, Jan 09, 2004 at 09:51:36AM -0800, bugzilla-daemon@bugzilla.spamassassin.org wrote:
> This is the bug I've been dealing with where the file attachment is treated as 
> part of the message and the base64 code of the file is probably causing the 
> rule to trigger.

FYI: 2.70 will have a smarter MIME parser that will skip attachments
and basically anything that isn't text/* or message/*.
Comment 4 Theo Van Dinter 2004-01-24 11:13:46 UTC 
the attachment is simply "~/foo" btw.

this should be fixed with the new mime parser.

*** This bug has been marked as a duplicate of 1527 ***
Comment 5 Nick Leverton 2004-01-26 03:48:23 UTC 
Subject: Re:  False positives on OBFUSCATING_COMMENT

On Sat, Jan 24, 2004 at 12:08:30PM -0800, bugzilla-daemon@bugzilla.spamassassin.org wrote:
> ------- Additional Comments From felicity@kluge.net  2004-01-24 11:13 -------
> the attachment is simply "~/foo" btw.

Oops!  Sorry, I do not know how that happened !  It was in a file called
foo, which I thought I'd uploaded.

Nick