View Javadoc

1   /*****************************************************************
2    * Licensed to the Apache Software Foundation (ASF) under one   *
3    * or more contributor license agreements.  See the NOTICE file *
4    * distributed with this work for additional information        *
5    * regarding copyright ownership.  The ASF licenses this file   *
6    * to you under the Apache License, Version 2.0 (the            *
7    * "License"); you may not use this file except in compliance   *
8    * with the License.  You may obtain a copy of the License at   *
9    *                                                              *
10   *   http://www.apache.org/licenses/LICENSE-2.0                 *
11   *                                                              *
12   * Unless required by applicable law or agreed to in writing,   *
13   * software distributed under the License is distributed on an  *
14   * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY       *
15   * KIND, either express or implied.  See the License for the    *
16   * specific language governing permissions and limitations      *
17   * under the License.                                           *
18   ****************************************************************/
19  
20  package org.apache.james.transport.matchers;
21  
22  import org.apache.mailet.RFC2822Headers;
23  import org.apache.mailet.Mail;
24  import org.apache.oro.text.regex.MalformedPatternException;
25  
26  import javax.mail.MessagingException;
27  
28  /***
29   * This is based on a sample filter.cfg for a Netscape Mail Server to stop
30   * spam.
31   *
32   */
33  public class NESSpamCheck extends GenericRegexMatcher {
34      protected Object NESPatterns[][] = {{RFC2822Headers.RECEIVED, "GAA.*-0600.*EST"},
35      {RFC2822Headers.RECEIVED, "XAA.*-0700.*EDT"},
36      {RFC2822Headers.RECEIVED, "xxxxxxxxxxxxxxxxxxxxx"},
37      {RFC2822Headers.RECEIVED, "untrace?able"},
38      {RFC2822Headers.RECEIVED, "from (baby|bewellnet|kllklk) "},
39      {RFC2822Headers.TO, "Friend@public//.com"},
40      {RFC2822Headers.TO, "user@the[-_]internet"},
41      {RFC2822Headers.DATE, "/[0-9]+/.+[AP]M.+Time"},
42      {RFC2822Headers.SUBJECT, "^//(?ADV?[:;)]"},
43      {RFC2822Headers.MESSAGE_ID, "<>"},
44      {RFC2822Headers.MESSAGE_ID_VARIATION, "<>"},
45      {RFC2822Headers.MESSAGE_ID_VARIATION, "<(419//.43|989//.28)"},
46      {"X-MimeOLE", "MimeOLE V[^0-9]"},
47              //Added 20-Jun-1999.  Appears to be broken spamware.
48      {"MIME-Version", "1.0From"},
49              //Added 28-July-1999.  Check X-Mailer for spamware.
50      {"X-Mailer", "DiffondiCool"},
51      {"X-Mailer", "Emailer Platinum"},
52      {"X-Mailer", "eMerge"},
53      {"X-Mailer", "Crescent Internet Tool"},
54              //Added 4-Apr-2000.  Check X-Mailer for Cybercreek Avalanche
55      {"X-Mailer", "Avalanche"},
56              //Added 21-Oct-1999.  Subject contains 20 or more consecutive spaces
57      {"Subject", "                    "},
58              //Added 31-Mar-2000.  Invalid headers from MyGuestBook.exe CGI spamware
59      {"MessageID", "<.+>"},
60      {"X-References", "0[A-Z0-9]+, 0[A-Z0-9]+$"},
61      {"X-Other-References", "0[A-Z0-9]+$"},
62      {"X-See-Also", "0[A-Z0-9]+$"},
63              //Updated 28-Apr-1999.  Check for "Sender", "Resent-From", or "Resent-By"
64              // before "X-UIDL".  If found, then exit.
65      {RFC2822Headers.SENDER, ".+"},
66      {RFC2822Headers.RESENT_FROM, ".+"},
67      {"Resent-By", ".+"},
68              //Updated 19-May-1999.  Check for "X-Mozilla-Status" before "X-UIDL".
69      {"X-Mozilla-Status", ".+"},
70              //Updated 20-Jul-1999.  Check for "X-Mailer: Internet Mail Service"
71              // before "X-UIDL".
72      {"X-Mailer", "Internet Mail Service"},
73              //Updated 25-Oct-1999.  Check for "X-ID" before "X-UIDL".
74      {"X-ID", ".+"},
75              //X-UIDL is a POP3 header that should normally not be seen
76      {"X-UIDL", ".*"},
77              //Some headers are valid only for the Pegasus Mail client.  So first check
78              //for Pegasus header and exit if found.  If not found, check for
79              //invalid headers: "Comments: Authenticated sender", "X-PMFLAGS" and "X-pmrqc".
80      {"X-mailer", "Pegasus"},
81              //Added 27-Aug-1999.  Pegasus now uses X-Mailer instead of X-mailer.
82      {"X-Mailer", "Pegasus"},
83              //Added 25-Oct-1999.  Check for X-Confirm-Reading-To.
84      {"X-Confirm-Reading-To", ".+"},
85              //Check for invalid Pegasus headers
86      {RFC2822Headers.COMMENTS, "Authenticated sender"},
87      {"X-PMFLAGS", ".*"},
88      {"X-Pmflags", ".*"},
89      {"X-pmrqc", ".*"},
90      {"Host-From:envonly", ".*"}};
91  
92      public void init() throws MessagingException {
93          //No condition passed... just compile a bunch of regular expressions
94          try {
95              compile(NESPatterns);
96          } catch(MalformedPatternException mp) {
97              throw new MessagingException("Could not initialize NES patterns", mp);
98          }
99      }
100 }