Jump to content

Header parsing, again.


Recommended Posts

I saw this topic addressed earlier, but it seemed to peter out with no resolution... I'm using an AppleScript in Mac OS X's Mail.app to report to SpamCop, enclosing full header and content. More often than not, SpamCop chokes on the headers, and refuses to parse the body of the message for links.

I've sent one of my reports to myself, and here's the header section...

From p6njzsc[at]miss-right.com Mon Mar  8 12:27:47 2004
Return-Path: <p6njzsc[at]miss-right.com>
Delivered-To: fritza[at]manoverboard.org
Received: (qmail 3887 invoked from network); 8 Mar 2004 18:26:41 -0000
Received: from cp86416-b.roemd1.lb.home.nl (
  by with SMTP; 8 Mar 2004 18:26:41 -0000
Received: from [] by cp86416-b.roemd1.lb.home.nl id <8557075-06812>; Mon, 08 Mar 2004 22:24:31 +0400
Message-ID: <87in$60sw8486xmb-i7r$$t[at]2y3axy>
From: "Shawn Lin" <p6njzsc[at]miss-right.com>
Reply-To: "Shawn Lin" <p6njzsc[at]miss-right.com>
To: fritza[at]manoverboard.org
Subject: face full of cum d y xokhqdq  qso ra
Date: Mon, 08 Mar 04 22:24:31 GMT
X-Mailer: Internet Mail Service (5.5.2650.21)
MIME-Version: 1.0
Content-Type: multipart/alternative;
X-Priority: 3
X-MSMail-Priority: Normal

As received by me, the first and third Received: headers are unbroken. The second is broken (as it was when it arrived), with the second line indented -- by a single space, but indented. The Content-Type: header is deeply indented. All other headers are reasonably short. Then comes a blank line, and the content.

The mail agent responsible for the single-space indent, by the way, is qmail.

On the face of it, this complies with the explanation given for the error. The message is, as far as I can tell, in the original format, and header breaks are escaped with indentations. Maybe the scri_pt has an off-by-one on the indent detection?

Or have I missed something?

-- F

Link to comment
Share on other sites

Can you confirm that there are still no breaks in the long header lines when you submit them to SpamCop, perhaps by forwarding to yourself like you forward to your submit address?

The space or tab as the first character of a line is a standards-compliant method of indicating that the line is a continuation of the previous line.

Link to comment
Share on other sites

The original message in this thread included just such a header. Here is another, forwarded to myself, and rejected for content-scanning by SpamCop as bad. I also include the first two lines of the body of the spam:

From KimmyBearLovesCummmm231[at]this-domain-mails.net Mon Mar  8 18:56:08 2004
Return-Path: <errors[at]this-domain-mails.net>
Delivered-To: fritza[at]manoverboard.org
Received: (qmail 4823 invoked from network); 9 Mar 2004 00:55:27 -0000
Received: from this-domain-mails.net (
  by with SMTP; 9 Mar 2004 00:55:27 -0000
Message-ID: <1078793444.005999.9067066[at]>
From: Kimmy Bear <KimmyBearLovesCummmm231[at]this-domain-mails.net>
To: fritza[at]manoverboard.org
Reply-To: KimmyBearLovesCummmm231[at]this-domain-mails.net
Date: 08 Mar 2004 17:27:32 -0600
Subject: These girls LOVE CUM BATHS!!!
MIME-Version: 1.0
Content-type: text/html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">

Note that in this case, there aren't even any particularly long lines to wrap.

-- F

Link to comment
Share on other sites

All I can say is that I copied your last example, pasted it into the web-form, and it parsed through with no errors. On the other hand, manipulating your first example to include the missing components (bit of a body, boundary lines, etc.) and it parsed also. So there appears to be something that gets "corrected" in your copy and paste as compared to what's actually getting submitted. Not a lot of help I know, it's just that I can't seem to recreate your "problem" using your examples ..??

Link to comment
Share on other sites

I tried pasting the body of my report, as mailed to myself, into the web-submission form. It parsed cleanly. There's no opportunity for cleanup in this process: Click at start-of-body, shift-click at end-of-message, copy, switch from Mail to Safari, select the submission form, paste.

I think I've shown that the reports are leaving my mailbox in the proper format -- a mailed copy looks right, and the mailed content parses when presented directly to the scri_pt. Somewhere after my mailing and before the scri_pt, my reports are getting munged. Is there a way to pin this down better, or will I just have to live with body-link reporting being broken most of the time?

Near as I can tell, I'm not doing anything wrong. If you have any other suggestions, I'd be glad to hear them.

-- F

Link to comment
Share on other sites


This topic is now archived and is closed to further replies.

  • Create New...