From 1678075da31b6939396a95b9aa2c93c90ee7485b Mon Sep 17 00:00:00 2001
From: Vsevolod Stakhov <vsevolod@highsecure.ru>
Date: Sun, 24 Jan 2016 14:10:33 +0000
Subject: [PATCH] Add rule to detect spammers attempts to cheat mime parsing

---
 rules/misc.lua | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/rules/misc.lua b/rules/misc.lua
index 90767d70c..e49603278 100644
--- a/rules/misc.lua
+++ b/rules/misc.lua
@@ -185,3 +185,36 @@ rspamd_config.HEADER_FORGED_MDN = {
   group = 'headers',
   description = 'Read confirmation address is different to return path'
 }
+
+local headers_unique = {
+  'Content-Type',
+  'Content-Transfer-Encoding',
+  'Date',
+  'Message-ID'
+}
+
+rspamd_config.MULTIPLE_UNIQUE_HEADERS = {
+  callback = function (task)
+    local res = 0
+    local res_tbl = {}
+    
+    for i,hdr in ipairs(headers_unique) do
+      local h = task:get_header_full(hdr)
+      
+      if h and #h > 1 then
+        res = res + 1
+        table.insert(res_tbl, hdr)
+      end
+    end
+    
+    if res > 0 then
+      return true,res,table.concat(res_tbl, ',')
+    end
+    
+    return false
+  end,
+
+  score = 5.0,
+  group = 'headers',
+  description = 'Repeated unique headers'
+}
-- 
2.39.5