1 /****************************************************************
2 * Licensed to the Apache Software Foundation (ASF) under one *
3 * or more contributor license agreements. See the NOTICE file *
4 * distributed with this work for additional information *
5 * regarding copyright ownership. The ASF licenses this file *
6 * to you under the Apache License, Version 2.0 (the *
7 * "License"); you may not use this file except in compliance *
8 * with the License. You may obtain a copy of the License at *
9 * *
10 * http://www.apache.org/licenses/LICENSE-2.0 *
11 * *
12 * Unless required by applicable law or agreed to in writing, *
13 * software distributed under the License is distributed on an *
14 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY *
15 * KIND, either express or implied. See the License for the *
16 * specific language governing permissions and limitations *
17 * under the License. *
18 ****************************************************************/
19
20
21
22 package org.apache.james.transport.matchers;
23
24 import javax.mail.MessagingException;
25
26 import org.apache.mailet.base.RFC2822Headers;
27 import org.apache.oro.text.regex.MalformedPatternException;
28
29 /**
30 * This is based on a sample filter.cfg for a Netscape Mail Server to stop
31 * spam.
32 *
33 */
34 public class NESSpamCheck extends GenericRegexMatcher {
35 protected Object NESPatterns[][] = {{RFC2822Headers.RECEIVED, "GAA.*-0600.*EST"},
36 {RFC2822Headers.RECEIVED, "XAA.*-0700.*EDT"},
37 {RFC2822Headers.RECEIVED, "xxxxxxxxxxxxxxxxxxxxx"},
38 {RFC2822Headers.RECEIVED, "untrace?able"},
39 {RFC2822Headers.RECEIVED, "from (baby|bewellnet|kllklk) "},
40 {RFC2822Headers.TO, "Friend@public\\.com"},
41 {RFC2822Headers.TO, "user@the[-_]internet"},
42 {RFC2822Headers.DATE, "/[0-9]+/.+[AP]M.+Time"},
43 {RFC2822Headers.SUBJECT, "^\\(?ADV?[:;)]"},
44 {RFC2822Headers.MESSAGE_ID, "<>"},
45 {RFC2822Headers.MESSAGE_ID_VARIATION, "<>"},
46 {RFC2822Headers.MESSAGE_ID_VARIATION, "<(419\\.43|989\\.28)"},
47 {"X-MimeOLE", "MimeOLE V[^0-9]"},
48 //Added 20-Jun-1999. Appears to be broken spamware.
49 {"MIME-Version", "1.0From"},
50 //Added 28-July-1999. Check X-Mailer for spamware.
51 {"X-Mailer", "DiffondiCool"},
52 {"X-Mailer", "Emailer Platinum"},
53 {"X-Mailer", "eMerge"},
54 {"X-Mailer", "Crescent Internet Tool"},
55 //Added 4-Apr-2000. Check X-Mailer for Cybercreek Avalanche
56 {"X-Mailer", "Avalanche"},
57 //Added 21-Oct-1999. Subject contains 20 or more consecutive spaces
58 {"Subject", " "},
59 //Added 31-Mar-2000. Invalid headers from MyGuestBook.exe CGI spamware
60 {"MessageID", "<.+>"},
61 {"X-References", "0[A-Z0-9]+, 0[A-Z0-9]+$"},
62 {"X-Other-References", "0[A-Z0-9]+$"},
63 {"X-See-Also", "0[A-Z0-9]+$"},
64 //Updated 28-Apr-1999. Check for "Sender", "Resent-From", or "Resent-By"
65 // before "X-UIDL". If found, then exit.
66 {RFC2822Headers.SENDER, ".+"},
67 {RFC2822Headers.RESENT_FROM, ".+"},
68 {"Resent-By", ".+"},
69 //Updated 19-May-1999. Check for "X-Mozilla-Status" before "X-UIDL".
70 {"X-Mozilla-Status", ".+"},
71 //Updated 20-Jul-1999. Check for "X-Mailer: Internet Mail Service"
72 // before "X-UIDL".
73 {"X-Mailer", "Internet Mail Service"},
74 //Updated 25-Oct-1999. Check for "X-ID" before "X-UIDL".
75 {"X-ID", ".+"},
76 //X-UIDL is a POP3 header that should normally not be seen
77 {"X-UIDL", ".*"},
78 //Some headers are valid only for the Pegasus Mail client. So first check
79 //for Pegasus header and exit if found. If not found, check for
80 //invalid headers: "Comments: Authenticated sender", "X-PMFLAGS" and "X-pmrqc".
81 {"X-mailer", "Pegasus"},
82 //Added 27-Aug-1999. Pegasus now uses X-Mailer instead of X-mailer.
83 {"X-Mailer", "Pegasus"},
84 //Added 25-Oct-1999. Check for X-Confirm-Reading-To.
85 {"X-Confirm-Reading-To", ".+"},
86 //Check for invalid Pegasus headers
87 {RFC2822Headers.COMMENTS, "Authenticated sender"},
88 {"X-PMFLAGS", ".*"},
89 {"X-Pmflags", ".*"},
90 {"X-pmrqc", ".*"},
91 {"Host-From:envonly", ".*"}};
92
93 public void init() throws MessagingException {
94 //No condition passed... just compile a bunch of regular expressions
95 try {
96 compile(NESPatterns);
97 } catch(MalformedPatternException mp) {
98 throw new MessagingException("Could not initialize NES patterns", mp);
99 }
100 }
101 }