From: Anton Yuzhaninov <citrin+git@citrin.ru>
Date: Mon, 21 Dec 2020 18:40:41 +0000 (+0000)
Subject: [Minor] Add FORGED_X_MAILER rule for X-Mailer used by spamboots
X-Git-Tag: 2.7~52^2~1
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=689c49dd1ad5a588d4cd0e01044bb47407d73609;p=rspamd.git

[Minor] Add FORGED_X_MAILER rule for X-Mailer used by spamboots
---

diff --git a/rules/regexp/headers.lua b/rules/regexp/headers.lua
index c47205fea..3a044c498 100644
--- a/rules/regexp/headers.lua
+++ b/rules/regexp/headers.lua
@@ -993,3 +993,23 @@ reconf['OLD_X_MAILER'] = {
   score = 2.0,
   group = 'headers',
 }
+
+-- X-Mailer header values which should not occur (in the modern mail) at all
+local bad_x_mailers = {
+  -- header name repeated in the header value
+  [[X-Mailer: ]],
+  -- Mozilla Thunderbird uses User-Agnet header, not X-Mailer
+  -- Early Thunderbird had U-A like:
+  -- Mozilla Thunderbird 1.0.2 (Windows/20050317)
+  -- Thunderbird 2.0.0.23 (X11/20090812)
+  [[(?:Mozilla )?Thunderbird \d]],
+  -- Was used by Yahoo Groups in 2000s
+  [[eGroups Message Poster]],
+}
+
+reconf['FORGED_X_MAILER'] = {
+  description = 'Forged X-Mailer header',
+  re = string.format('X-Mailer=/^(?:%s)/', table.concat(bad_x_mailers, '|')),
+  score = 4.0,
+  group = 'headers',
+}