rspamd: More comprehensive attachment handling (#3273)

- block all Office documents with macros
- don’t just block all doc files
- mark some more Windows executable extensions as bad
master
Michael Kuron 2020-01-17 22:19:12 +01:00 committed by André Peters
parent 5da3895eea
commit 4c2e13009b
2 changed files with 12 additions and 1 deletions

View File

@ -4,4 +4,6 @@ oletools {
# needs to be set explicitly for Rspamd < 1.9.5 # needs to be set explicitly for Rspamd < 1.9.5
scan_mime_parts = true; scan_mime_parts = true;
# mime-part regex matching in content-type or filename # mime-part regex matching in content-type or filename
# block all macros
extended = true;
} }

View File

@ -4,13 +4,22 @@ bad_extensions = {
scr = 4, scr = 4,
lnk = 4, lnk = 4,
exe = 1, exe = 1,
msi = 1,
msp = 1,
msu = 1,
jar = 2, jar = 2,
com = 4, com = 4,
bat = 4, bat = 4,
cmd = 4,
ps1 = 4,
ace = 4, ace = 4,
arj = 4, arj = 4,
cab = 3, cab = 3,
doc = 10, vbs = 4,
hta = 4,
shs = 4,
wsc = 4,
wsf = 4,
}; };
# Extensions that are particularly penalized for archives # Extensions that are particularly penalized for archives