* match content disposition better

[spamassassin_config.git] / common / misc_spam

diff --git a/common/misc_spam b/common/misc_spam
index 06c5227545ba1243297795e0203fa021a803144c..296e83cace09cc9cacc5cfbbad83250a208671e6 100644 (file)
--- a/common/misc_spam
+++ b/common/misc_spam
@@ -171,7 +171,7 @@ describe FAILNOTE   bounced spam
 score FAILNOTE         2
 
 # blarson 2007-06-28
-rawbody CTINLINE       /^Content\-Disposition\: inline\;\b/
+full CTINLINE  /^Content\-Disposition\: inline\;\b/
 describe CTINLINE      Inline attachment
 score CTINLINE         1
 
@@ -313,7 +313,7 @@ describe TINYFONT   tiny font specified
 score TINYFONT         3
 
 # blarson 2008-04-03
-rawbody ZIPFILE                /\bfilename\=.*\.zip\b/i
+full ZIPFILE           /\bfilename\=.*\.zip\b/i
 describe ZIPFILE       zipfile attachment
 score ZIPFILE          0.5
 
@@ -493,9 +493,9 @@ header CTOCTET_STREAM       Content-Type =~ /octet-stream/i
 describe CTOCTET_STREAM        Content type is octet-stream
 score CTOCTET_STREAM   0.5
 
-header RTF_ATTACH      Content-Type =~ /name=.+\.rtf/i
-describe RTF_ATTACH    Contains an RTF Attachment
-score RTF_ATTACH       0.5
+full RTF_ATTACH                /^Content-Disposition:.+name=.+\.(rtf|doc)/i
+describe RTF_ATTACH    Contains an RTF or DOC Attachment
+score RTF_ATTACH       2
 
 meta RTF_SPAM          CTOCTET_STREAM && RTF_ATTACH
 describe RTF_SPAM      Content type is octet-stream and has an RTF Attachment