[Mailman-Users] FW: Spamassassin content preview ending up posted to list

[Mark Sapiro]

On 11/05/2014 05:50 PM, Peter Shute wrote:
...
> X-Ham-Report: Spam detection software, running on the system "cloud3.emwd.com", has  identified this incoming email as possible spam.  The original message  has been attached to this so you can view it (if it isn't spam) or label  similar future email.  If you have any questions, see  root\@localhost for details.
>  
>  Content preview:  I heard or saw 5 Lewin's Rails and 12 Spotless Crakes today
>     at a newly discovered wetland at Yandina Creek on the Sunshine Coast. Other
>     good birds about included Black-necked Stork, Red-necked Avocet, Little Grassbird
>     and a free-flying Mallard; genuinely wild Mallards are rare in south-east
>     Queensland. This extensive area of grassland and wetland has enormous potential
>     but is threatened by development. The Sunshine Coast Regional Council is
>    being urged to purchase some of the privately owned land to conserve and manage
>     the wetlands. See here for pictures, further information and a link where
>     people can contact the mayor if they want to see the area protected: http://sunshinecoastbirdsblogspot.com.au/2014/11/yandina-creek-wetlands-and-its.html
>     Greg Roberts? [...] 
>  
>  Content analysis details:   (-0.9 points, 5.0 required)
>  


OK. I poked around and found the archived message at
<http://bioacoustics.cse.unsw.edu.au/archives/html/birding-aus/2014-11/msg00039.html>.

Something seemed to think that the line between 'Greg Roberts? [...]'
and 'Content analysis details:' was empty even though in your post at
least, it contains an ascii space.

An 'empty' line, i.e. the sequence <CR><LF><CR><LF> terminates the
headers and the rest is the body.

This is really wierd because in the archived message, the List-* and
X-Mailman headers are all added after the X-Spam-Flag: NO header which
says at the point Mailman added those headers, it knew that the headers
didn't end at the point prior to the "Content preview" line, but when
the message was archived and presumably when sent to the list, that line
started the 'body'

Also, if you base64 decode the encoded data at the end of the archived
message, you see the actual plain text message body with some list
footers added, and curiously, it too is missing the dot in the URL.

I created a composite message with the body from the 'forwarded' message
from your post and the headers from Outlook, and posted it to a list on
my development server, and it all worked as expected and the only
missing dot was in the X-Ham-Report: "Content preview".

The fact that the dot is also missing in the base64 encoded plain text
says it may well have been missing in the original, but it wasn't
missing in the message quoted in your post, so that's a mystery.

Anyway, your Mailman or at least its archiving process seems to be to
blame here, but mine works, and yours is cPanel so see
<http://wiki.list.org/display/DOC/Mailman+and+CPanel>

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan