Spam assassin custom rule to block PDF files having Urls.

[Matus UHLAR - fantomas]

On 01.07.22 20:36, Indunil Jayasooriya wrote:
>uri SPAM_1Jul2022_uri_1 /https?\:\/\/t.ly\/8R_H/i
>describe SPAM_1Jul2022_uri_1 Email containing above words
>score SPAM_1Jul2022_uri_1 11.0
>
>It can NOT detect this url inside the PDF file.
>
>But, if I just write it to the mail body, It can detect it.
>
>I need a rule that can detect urls inside a PDF file. Can you guide me?

do you have SA 4.0 installed and plugin:
Mail::SpamAssassin::Plugin::ExtractText
enabled?

did you install pdftotext and configure SA to use it?

>On Fri, Jul 1, 2022 at 6:17 PM Indunil Jayasooriya <indunil75 at gmail.com>
>wrote:
>> We get some PDF files. When we open them there is a link inside the PDF
>> file. We don't need these since these urls may be harmful.
>>
>> Here's one Url that the PDF file contained.
>>
>> https://t.ly/8R_H
>>
>> Can we block these with Spam Assassin?
>>
>> If so, how to write a custom rule for it?
>>
>> Below Url has some instructions.
>>
>> https://cwiki.apache.org/confluence/display/SPAMASSASSIN/writingrules

-- 
Matus UHLAR - fantomas, uhlar at fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Nothing is fool-proof to a talented fool.