Bug 87 - Formatting Error in report using pine
Summary: Formatting Error in report using pine
Status: RESOLVED DUPLICATE of bug 130
Alias: None
Product: Spamassassin
Classification: Unclassified
Component: Libraries (show other bugs)
Version: 2.11
Hardware: PC Linux
: P2 normal
Target Milestone: ---
Assignee: Craig Hughes
URL:
Whiteboard:
Keywords:
: 203 (view as bug list)
Depends on:
Blocks:
 
Reported: 2002-03-07 07:07 UTC by Shane Williams
Modified: 2002-04-10 07:40 UTC (History)
2 users (show)


Attachment Type Modified Status Actions Submitter/CLA Status
Content-Transfer-Encoding patch patch None Daniel Rogers [NoCLA]
Whoops, that first one had an errant blank line, use this one. patch None Daniel Rogers [NoCLA]
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Shane Williams 2002-03-07 07:07:15 UTC 
Certain messages, when viewed through pine and marked as spam start to print the
full body report and then are cut off mid line, with pine showing this error on
the next line:

   [Error: Formatting error: Non-hexadecimal character in QP encoding]    

I seem to recall this being a bug in pre-2.0 versions, and I thought it was
fixed, but a query in bugzilla showed nothing.
Comment 1 Craig Hughes 2002-03-17 04:54:32 UTC 
Could you attach an email which does this to this bug?  It's probably a
description for one of the rules or something that's confusing pine.
Comment 2 Shane Williams 2002-03-17 14:09:14 UTC 
I've actually attached two.  One doesn't display any text at all (the SA report
is in the header), the other starts to print the SA report in the body (before I
switched reports to the header) and stops displaying in the middle of the report.

Here's the first (some of the headers removed):
---------------First message as stored in mailbox---------------------

Subject: *****SPAM***** Save Up To 75% on Life Insurance
MIME-Version: 1.0
From: ngrillen@yahoo.com
Date: Wed, 13 Mar 2002 06:30:04 -0500
Content-Type: text/plain
Reply-To: cochotasus@yahoo.com
Message-Id: <7HS85AI2.13OWRHSDAH6MB0EYSH.ngrillen@yahoo.com>
X-MSMail-Priority: Normal
To: gravielam@yahoo.com
Received: from aata.com by 5L5VNU3Y1QU.aata.com with SMTP for gravielam@yahoo.co
m; Wed, 13 Mar 2002 06:30:04 -0500
X-Priority: 3 (Normal)
X-Encoding: MIME
Content-Transfer-Encoding: quoted-printable
Importance: Normal
X-Spam-Status: Yes, hits=16.2 required=5.0 tests=FORGED_RCVD_FOUND,NO_REAL_NAME,
MSG_ID_ADDED_BY_MTA_2,EXCUSE_3,EXCUSE_7,CLICK_BELOW,MAILTO_WITH_SUBJ,MAILTO_LINK
,MAILTO_WITH_SUBJ_REMOVE,A_HREF_TO_REMOVE,CLICK_HERE_LINK,FORGED_YAHOO_RCVD vers
ion=2.11
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.11 (devel $Id: SpamAssassin.pm,v 1.68 200
2/03/04 01:22:24 hughescr Exp $)
X-Spam-Prev-Content-Type: multipart/alternative; boundary="----=_NextPart_1497_0
1465010628352136822"
X-Spam-Report: Detailed Report
SPAM: -------------------- Start SpamAssassin results ----------------------
  SPAM: This mail is probably spam.  The original message has been altered
  SPAM: so you can recognise or block similar unwanted mail in future.
  SPAM: See http://spamassassin.org/tag/ for more details.
  SPAM: 
  SPAM: Content analysis details:   (16.2 hits, 5 required)
  SPAM: Hit! (0.5 points)  Possibly-forged 'Received:' header found
  SPAM: Hit! (0.6 points)  From: does not include a real name
  SPAM: Hit! (1.8 points)  'Message-Id' was added by a relay (2)
  SPAM: Hit! (1.0 point)   BODY: Claims you can be removed from the list
  SPAM: Hit! (2.3 points)  BODY: Claims you can be removed from the list
  SPAM: Hit! (0.9 points)  BODY: Asks you to click below
  SPAM: Hit! (1.7 points)  BODY: Includes a link to send a mail with a subject
  SPAM: Hit! (-0.2 points) BODY: Includes a URL link to send an email
  SPAM: Hit! (0.4 points)  BODY: Includes a URL link to send an email with the s
ubject 'remove'
  SPAM: Hit! (3.5 points)  BODY: Link to a URL containing "remove"
  SPAM: Hit! (1.6 points)  BODY: Tells you to click on a URL
  SPAM: Hit! (2.1 points)  Forged yahoo.com 'Received:' header found
  SPAM: 
  SPAM: -------------------- End of SpamAssassin results ---------------------
Status: O
X-Status: 

This is a multi-part message in MIME format.


------=_NextPart_1497_01465010628352136822
Content-Type: text/plain;
        charset="iso-8859-1"
Content-Transfer-Encoding: Quoted-Printable

Save up to 75% on your Term Life Insurance! 
Compare rates from top insurance companies around the country 

In our life and times, it's important to plan for your family's future, while =

being comfortable financially. Choose the right Life Insurance policy today. 
Click the link below to compare the lowest rates and save up to 75% 

COMPARE YOUR COVERAGE 
http://biz38.freewebhost4all.com/lifequotes/627208/

You'll be able to compare rates and get a free application in less than a =
minute! 

*Get your FREE instant quotes...
*Compare the lowest prices, then...
*Select a company and Apply Online. 

GET A FREE QUOTE NOW! 
You can't predict the future, but you can always prepare for it. 
http://biz38.freewebhost4all.com/lifequotes/627208/



 


------=_NextPart_1497_01465010628352136822
Content-Type: text/html;
        charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

<html>
<head>
</head>
<body>

<center>
<font face=3D"times" size=3D"6" color=3D"#000000">Save up to 
<font color=3D"#ff0000">75%</font> on your Term Life Insurance!</font>
<br>  
<font face=3D"times" size=3D"4" color=3D"#000000">
<i>Compare rates from top insurance companies around the country</i></font>
<br><br>
<font face=3D"arial" size=3D"4" color=3D"#7084D6">
<b>In our life and times, it's important to plan for your family's future, =
while 
<br>being comfortable financially.  Choose the right Life Insurance policy =
today.</font>
<p>
<font face=3D"arial" size=3D"3" color=3D"#000000">
<i>Click the link below to compare the lowest rates and save up to <font =
color=3D"#ff0000">75%</font></i></b></font>  
<p>
<a href=3D"http://biz38.freewebhost4all.com/lifequotes/627208/"><font =
face=3D"arial" size=3D"4">
<b>COMPARE YOUR COVERAGE</b></font></a>
<p>
<font face=3D"times" size=3D"5" color=3D"#000000">
You'll be able to compare rates and get a free application in <i>less than a =
minute!</i></font>
<p>
<font face=3D"arial" size=3D"5" color=3D"#ff0000">
<b>*Get your FREE instant quotes...<br>
*Compare the lowest prices, then...<br>
*Select a company and Apply Online.</b></font>
<p>
<a href=3D"http://biz38.freewebhost4all.com/lifequotes/627208/"><font =
face=3D"arial" size=3D"5">
<b>GET A FREE QUOTE NOW!</b></font></a>
<br>
<font face=3D"arial" size=3D"2" color=3D"#000000">
<i>You can't predict the future, but you can always prepare for it.=
</i></font>
<br><br>
<font size=3D"1" color=3D"777783" face=3D"Tahoma, Arial, Helvetica, =
sans-serif">Please <a href=3D"mailto:agotaditas@yahoo.com?subject=3Dremove"><fon
t =
color=3D"777783">click here</font></a> if you would like to be removed from this
 =
list.</font><br><br>
</center>
</body>
</html>



------=_NextPart_1497_01465010628352136822--
-----------------End of first message---------------------------

Here's how it appears in pine (without full headers):

----------------First message displayed in pine-------------------
Date: Wed, 13 Mar 2002 06:30:04 -0500
From: ngrillen@yahoo.com
Reply-To: cochotasus@yahoo.com
To: gravielam@yahoo.com
Subject: *****SPAM***** Save Up To 75% on Life Insurance


   [Error: Formatting error: Non-hexadecimal character in QP encoding]    
----------------End of first message in pine-----------------------


-----------------Start of second message as stored------------------
Message-Id: <0P0PQN8118IR7.6LD03Y8B4X7A6.JUSTICE@P0PMAILER.ORG>
From: JUSTICE@P0PMAILER.ORG
X-Priority: 3 (Normal)
Subject: *****SPAM***** Mortgage Rates Have Never Been Lower
Received: from aartrageous.com by 9XI80K1Y.aartrageous.com with SMTP for USENETB
OY@P0PMAILER.ORG; Thu, 07 Mar 2002 01:47:45 -0500
Reply-To: 2COOL@P0PMAILER.ORG
Content-Transfer-Encoding: Quoted-Printable
To: USENETBOY@P0PMAILER.ORG
MIME-Version: 1.0
X-MSMail-Priority: Normal
X-Encoding: MIME
Content-Type: text/plain
Date: Thu, 07 Mar 2002 01:47:45 -0500
Importance: Normal
X-Spam-Status: Yes, hits=27.7 required=5.0 tests=FORGED_RCVD_FOUND,NO_REAL_NAME,
MSG_ID_ADDED_BY_MTA_2,TAKE_ACTION_NOW,MORTGAGE_RATES,CLICK_BELOW,REMOVE_PAGE,A_H
REF_TO_REMOVE,CLICK_HERE_LINK,KNOWN_BAD_DIALUPS,RCVD_IN_OSIRUSOFT_COM version=2.
11
X-Spam-Flag: YES
X-Spam-Checker-Version: SpamAssassin 2.11 (devel $Id: SpamAssassin.pm,v 1.68 200
2/03/04 01:22:24 hughescr Exp $)
X-Spam-Prev-Content-Type: multipart/alternative; boundary="----=_NextPart_853_34
755700"
Status: RO
X-Status: 

SPAM: -------------------- Start SpamAssassin results ----------------------
SPAM: This mail is probably spam.  The original message has been altered
SPAM: so you can recognise or block similar unwanted mail in future.
SPAM: See http://spamassassin.org/tag/ for more details.
SPAM: 
SPAM: Content analysis details:   (27.7 hits, 5 required)
SPAM: Hit! (0.5 points)  Possibly-forged 'Received:' header found
SPAM: Hit! (0.6 points)  From: does not include a real name
SPAM: Hit! (1.8 points)  'Message-Id' was added by a relay (2)
SPAM: Hit! (6.2 points)  BODY: Tells you to 'take action now!'
SPAM: Hit! (5.8 points)  BODY: Information on mortgage rates
SPAM: Hit! (0.9 points)  BODY: Asks you to click below
SPAM: Hit! (4.1 points)  BODY: URL of page called "remove"
SPAM: Hit! (3.5 points)  BODY: Link to a URL containing "remove"
SPAM: Hit! (1.6 points)  BODY: Tells you to click on a URL
SPAM: Hit! (0.7 points)  Received via known spam-harbouring dialups
SPAM: Hit! (2.0 points)  Received via a relay in relays.osirusoft.com
SPAM:                    [RBL check: found 123.181.59.63.relays.osirusoft.com.]
SPAM: 
SPAM: -------------------- End of SpamAssassin results ---------------------

This is a multi-part message in MIME format.

------=_NextPart_853_34755700
Content-Type: text/plain;
        charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

We will help you get the mortgage loan you want! 

Only takes 2 minutes to fill out our form. 
http://www.bulletwebs.com/mortgage/index.html

Whether a new home loan is what you seek or to refinance your current home =
loan
at a lower interest rate and payment, we can help!

Mortgage rates haven't been this low in the last 12 months, take action now!
Refinance your home with us and include all of those pesky credit card bills =
or
use the extra cash for that pool you've always wanted... 

Where others says NO, we say YES!!!
Even if you have been turned down elsewhere, we can help! 

Easy terms! Our mortgage referral service combines the
highest quality loans with most economical rates and the easiest =
qualification!

Click Here to fill out our form. 
http://www.bulletwebs.com/mortgage/index.html

------------------------------------------------------------------------- 
Click here to be removed! 
http://www.bulletwebs.com/remove.html 


------=_NextPart_853_34755700
Content-Type: text/html;
        charset=iso-8859-1
Content-Transfer-Encoding: quoted-printable

<html>
<body>
<P style=3D"TEXT-ALIGN: center" align=3Dcenter><B><FONT face=3D"Times New Roman"
  color=3Dred size=3D5><SPAN
  style=3D"FONT-WEIGHT: bold; FONT-SIZE: 18pt; COLOR: red">We will help you
get
  the mortgage loan you want!&nbsp;<BR></SPAN></FONT></B><B><FONT
  color=3Dblack><SPAN style=3D"FONT-WEIGHT: bold; COLOR: black">
<a href=3D"http://www.bulletwebs.com/mortgage/index.html">Only takes 2 minutes =
to fill out our form.</a>
<BR>Whether a new
  home loan is what you seek or<BR>to refinance your current home loan at a
  lower interest rate and payment, we can
  help!<BR><BR></SPAN></FONT></B><B><FONT color=3Dblack size=3D4><SPAN
  style=3D"FONT-WEIGHT: bold; FONT-SIZE: 13.5pt; COLOR: black">Mortgage rates
  haven't been this low in the last 12 months, take action
  now!<BR></SPAN></FONT></B><B><FONT color=3Dblack><SPAN
  style=3D"FONT-WEIGHT: bold; COLOR: black">Refinance your home with us and
  include all of those pesky credit card bills or<BR>use the extra cash for
that
  pool you've always wanted...&nbsp;<BR><BR></SPAN></FONT></B><B><FONT
  color=3Dblue size=3D4><SPAN
  style=3D"FONT-WEIGHT: bold; FONT-SIZE: 13.5pt; COLOR: blue">Where others
says
  NO, we say YES!!!<BR></SPAN></FONT></B><B><FONT color=3Dblack><SPAN
  style=3D"FONT-WEIGHT: bold; COLOR: black">Even if you have been turned down
  elsewhere, we can help!&nbsp;<BR><BR></SPAN></FONT></B><B><FONT
  color=3Dblue><SPAN style=3D"FONT-WEIGHT: bold; COLOR: blue">Easy
  terms!</SPAN></FONT></B><B><FONT color=3Dblack><SPAN
  style=3D"FONT-WEIGHT: bold; COLOR: black"> Our mortgage referral service
  combines the<U><BR>highest quality loans with most economical rates and
the
  easiest qualification</U>!<BR><BR></SPAN></FONT></B><B><FONT color=3Dred
  size=3D4>
<a href=3D"http://www.bulletwebs.com/mortgage/index.html">Click Here to fill =
out our form.</a>
<br><br>
-------------------------------------------------------------------------
<br>
<a href=3D"http://www.bulletwebs.com/remove.html">Click here to be removed!</a>
</html>
</body>


------=_NextPart_853_34755700--

------------------End of second message------------------------

-----------------Second message as displayed by pine-----------------
Date: Thu, 07 Mar 2002 01:47:45 -0500
From: JUSTICE@P0PMAILER.ORG
Reply-To: 2COOL@P0PMAILER.ORG
To: USENETBOY@P0PMAILER.ORG
Subject: *****SPAM***** Mortgage Rates Have Never Been Lower

SPAM: -------------------- Start SpamAssassin results ----------------------
SPAM: This mail is probably spam.  The original message has been altered
SPAM: so you can recognise or block similar unwanted mail in future.
SPAM: See http://spamassassin.org/tag/ for more details.
SPAM:
SPAM: Content analysis details:   (27.7 hits, 5 required)
SPAM: Hit! (0.5 points)  Possibly-forged 'Received:' header found
SPAM: Hit! (0.6 points)  From: does not include a real name
SPAM: Hit! (1.8 points)  'Message-Id' was ad
   [Error: Formatting error: Non-hexadecimal character in QP encoding]    

-----------------End of second message------------------------------
Comment 3 Daniel Rogers 2002-03-19 15:18:24 UTC 
I just cheched the pine sources, and here's the problem...

If the message is of the "Quoted-Printable" (or one of the parts is), pine
assumes that a '=' must be followed by either a \r (carriage return), another =
(not quite sure why), or 0-9A-F (case insensitive).  If it is followed by
anything else, that's the error that results.

Originally, that spam would have been a multi-part message, so the body parts
would have been parsed, instead of trying to display them.  However, when the
Content-Type header gets changed to text/plain, the Content-Transfer-Encoding
stays as Quoted-Printable.  This leaves pine trying to parse "------=_NextPart"
as Quoted-Printable text.

So, what's the solution?  I don't know, maybe changing Content-Transfer-Encoding
 to X-Spam-Prev-Content-Transfer-Encoding if you rewrite the content-type?

Of course, having said all that, there are also buggy spams that claim
quoted-printable for their text/html parts, but then don't actually _use_ QP in
the HTML...

Dan.
Comment 4 Craig Hughes 2002-03-25 16:42:28 UTC 
I think if a spam is buggy, that's not our problem :)  But we should not break 
stuff ourselves.  I think the X-Spam-Prev-Content-Transfer-Encoding is probably 
the way to go.  Needs to be reversed properly by spamassassin -d also.  If you 
want to implement this, feel free to assign it to yourself.  Assign it back to 
me if you attach a patch.
Comment 5 Daniel Rogers 2002-03-25 17:26:04 UTC 
Created attachment 16 [details]
Content-Transfer-Encoding patch
Comment 6 Daniel Rogers 2002-03-25 17:26:51 UTC 
Patch ahoy!

Dan.
Comment 7 Daniel Rogers 2002-03-25 17:28:19 UTC 
Created attachment 17 [details]
Whoops, that first one had an errant blank line, use this one.
Comment 8 Craig Hughes 2002-03-25 17:32:51 UTC 
Ok, applying patch temporarily, bug closing by marking as dupe of #130 for 
future reference.

*** This bug has been marked as a duplicate of 130 ***
Comment 9 Daniel Rogers 2002-04-10 15:40:52 UTC 
*** Bug 203 has been marked as a duplicate of this bug. ***