View Javadoc

1   /************************************************************************
2    * Copyright (c) 1999-2006 The Apache Software Foundation.             *
3    * All rights reserved.                                                *
4    * ------------------------------------------------------------------- *
5    * Licensed under the Apache License, Version 2.0 (the "License"); you *
6    * may not use this file except in compliance with the License. You    *
7    * may obtain a copy of the License at:                                *
8    *                                                                     *
9    *     http://www.apache.org/licenses/LICENSE-2.0                      *
10   *                                                                     *
11   * Unless required by applicable law or agreed to in writing, software *
12   * distributed under the License is distributed on an "AS IS" BASIS,   *
13   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or     *
14   * implied.  See the License for the specific language governing       *
15   * permissions and limitations under the License.                      *
16   ***********************************************************************/
17  
18  package org.apache.james.transport.matchers;
19  
20  import org.apache.mailet.RFC2822Headers;
21  import org.apache.mailet.Mail;
22  import org.apache.oro.text.regex.MalformedPatternException;
23  
24  import javax.mail.MessagingException;
25  
26  /***
27   * This is based on a sample filter.cfg for a Netscape Mail Server to stop
28   * spam.
29   *
30   */
31  public class NESSpamCheck extends GenericRegexMatcher {
32      protected Object NESPatterns[][] = {{RFC2822Headers.RECEIVED, "GAA.*-0600.*EST"},
33      {RFC2822Headers.RECEIVED, "XAA.*-0700.*EDT"},
34      {RFC2822Headers.RECEIVED, "xxxxxxxxxxxxxxxxxxxxx"},
35      {RFC2822Headers.RECEIVED, "untrace?able"},
36      {RFC2822Headers.RECEIVED, "from (baby|bewellnet|kllklk) "},
37      {RFC2822Headers.TO, "Friend@public//.com"},
38      {RFC2822Headers.TO, "user@the[-_]internet"},
39      {RFC2822Headers.DATE, "/[0-9]+/.+[AP]M.+Time"},
40      {RFC2822Headers.SUBJECT, "^//(?ADV?[:;)]"},
41      {RFC2822Headers.MESSAGE_ID, "<>"},
42      {RFC2822Headers.MESSAGE_ID_VARIATION, "<>"},
43      {RFC2822Headers.MESSAGE_ID_VARIATION, "<(419//.43|989//.28)"},
44      {"X-MimeOLE", "MimeOLE V[^0-9]"},
45              //Added 20-Jun-1999.  Appears to be broken spamware.
46      {"MIME-Version", "1.0From"},
47              //Added 28-July-1999.  Check X-Mailer for spamware.
48      {"X-Mailer", "DiffondiCool"},
49      {"X-Mailer", "Emailer Platinum"},
50      {"X-Mailer", "eMerge"},
51      {"X-Mailer", "Crescent Internet Tool"},
52              //Added 4-Apr-2000.  Check X-Mailer for Cybercreek Avalanche
53      {"X-Mailer", "Avalanche"},
54              //Added 21-Oct-1999.  Subject contains 20 or more consecutive spaces
55      {"Subject", "                    "},
56              //Added 31-Mar-2000.  Invalid headers from MyGuestBook.exe CGI spamware
57      {"MessageID", "<.+>"},
58      {"X-References", "0[A-Z0-9]+, 0[A-Z0-9]+$"},
59      {"X-Other-References", "0[A-Z0-9]+$"},
60      {"X-See-Also", "0[A-Z0-9]+$"},
61              //Updated 28-Apr-1999.  Check for "Sender", "Resent-From", or "Resent-By"
62              // before "X-UIDL".  If found, then exit.
63      {RFC2822Headers.SENDER, ".+"},
64      {RFC2822Headers.RESENT_FROM, ".+"},
65      {"Resent-By", ".+"},
66              //Updated 19-May-1999.  Check for "X-Mozilla-Status" before "X-UIDL".
67      {"X-Mozilla-Status", ".+"},
68              //Updated 20-Jul-1999.  Check for "X-Mailer: Internet Mail Service"
69              // before "X-UIDL".
70      {"X-Mailer", "Internet Mail Service"},
71              //Updated 25-Oct-1999.  Check for "X-ID" before "X-UIDL".
72      {"X-ID", ".+"},
73              //X-UIDL is a POP3 header that should normally not be seen
74      {"X-UIDL", ".*"},
75              //Some headers are valid only for the Pegasus Mail client.  So first check
76              //for Pegasus header and exit if found.  If not found, check for
77              //invalid headers: "Comments: Authenticated sender", "X-PMFLAGS" and "X-pmrqc".
78      {"X-mailer", "Pegasus"},
79              //Added 27-Aug-1999.  Pegasus now uses X-Mailer instead of X-mailer.
80      {"X-Mailer", "Pegasus"},
81              //Added 25-Oct-1999.  Check for X-Confirm-Reading-To.
82      {"X-Confirm-Reading-To", ".+"},
83              //Check for invalid Pegasus headers
84      {RFC2822Headers.COMMENTS, "Authenticated sender"},
85      {"X-PMFLAGS", ".*"},
86      {"X-Pmflags", ".*"},
87      {"X-pmrqc", ".*"},
88      {"Host-From:envonly", ".*"}};
89  
90      public void init() throws MessagingException {
91          //No condition passed... just compile a bunch of regular expressions
92          try {
93              compile(NESPatterns);
94          } catch(MalformedPatternException mp) {
95              throw new MessagingException("Could not initialize NES patterns", mp);
96          }
97      }
98  }