subject is deleted instead of rewritten

[Niki Waibel]

hello,

i wrote a similar email to the spamassassin mailinglist and they sayed that
the problem i have is possibly related to my milter (which is 
spamass-milter-0.1.3a).
i use spamassassin-2.43, sendmail-8.12.7, perl-5.8.0, gcc-3.2.1, 
binutils-2.13.2.1
on solaris8.

i found out that the Subject line is _removed_ if the mail is rated as
spam and ``Subject: '' is the ___first___ header line.

if ``Subject: '' is NOT the first header line (like it is in most email
clients), then everything? is fine (subject is rewritten).

i found this bug? during testing sendmail by doing a simple telnet.
in addition i recognized that the ``RCPT TO: '' name (i have used
address@hidden) which you see in the spamd log looses
its first character, if it is not in ``<'', ``>'' brackets.

here comes the smtplog of (like this it works, but you see here
that the first char of the rcpt name is lost):

telnet enterprise2 24   # port 24 for testing!
mail from: address@hidden
rcpt to: address@hidden
data
To: niki
Subject: hello you          $$$ 33

PORN SEX MONEY CASH
.
===
Jan  8 18:25:30 e2-1.newlogic.at spamd[28374]:
        processing message (unknown) for iki.waibel:126, expecting 69 bytes.
Jan  8 18:25:30 e2-1.newlogic.at spamd[28374]:
        identified spam (8.0/5.0) for iki.waibel:126 in 0.3 seconds, 69 bytes.

Jan  8 18:25:30 enterprise2 sm-mta[27888]: [ID 801593 mail.info] h08HMfoe027888:
        Milter add: header: X-Spam-Flag: YES
Jan  8 18:25:30 enterprise2 sm-mta[27888]: [ID 801593 mail.info] h08HMfoe027888:
        Milter add: header: X-Spam-Status: Yes, hits=8.0
        
required=5.0\n\ttests=ALL_CAP_PORN,CASHCASHCASH,DATE_MISSING,FROM_MISSING,\n\t
        SPAM_PHRASE_00_01,SUBJ_HAS_SPACES,TO_MALFORMED,\n\t
        UPPERCASE_50_75\n\tversion=2.43
Jan  8 18:25:30 enterprise2 sm-mta[27888]: [ID 801593 mail.info] h08HMfoe027888:
        Milter add: header: X-Spam-Level: ********
Jan  8 18:25:30 enterprise2 sm-mta[27888]: [ID 801593 mail.info] h08HMfoe027888:
        Milter add: header: X-Spam-Checker-Version:
        SpamAssassin 2.43 (1.115.2.20-2002-10-15-exp)
Jan  8 18:25:30 enterprise2 sm-mta[27888]: [ID 801593 mail.info] h08HMfoe027888:
        Milter change: header  Subject: from hello you         $$$ 33 to
        *****SPAM***** hello you          $$$ 33
Jan  8 18:25:30 enterprise2 sm-mta[27888]: [ID 801593 mail.info] h08HMfoe027888:
         Milter message: body replaced
===


like this (Subject goes first) it does not work correct:

telnet enterprise2 24   # port 24 for testing!
mail from: address@hidden
rcpt to: address@hidden
data
Subject: hello you          $$$ 33
To: niki

PORN SEX MONEY CASH
.
===
Jan  8 18:26:09 enterprise2 sm-mta[27888]: [ID 801593 mail.info] h08HMfof027888:
        Milter add: header: X-Spam-Flag: YES
Jan  8 18:26:09 enterprise2 sm-mta[27888]: [ID 801593 mail.info] h08HMfof027888:
        Milter add: header: X-Spam-Status: Yes,hits=9.5
        
required=5.0\n\ttests=ALL_CAP_PORN,CASHCASHCASH,DATE_MISSING,FROM_MISSING,\n\t  
 
        MISSING_HEADERS,SPAM_PHRASE_00_01,SUBJ_HAS_SPACES,\n\t
        UPPERCASE_25_50\n\tversion=2.43
Jan  8 18:26:09 enterprise2 sm-mta[27888]: [ID 801593 mail.info] h08HMfof027888:
        Milter add: header: X-Spam-Level: *********
Jan  8 18:26:09 enterprise2 sm-mta[27888]: [ID 801593 mail.info] h08HMfof027888:
        Milter add: header: X-Spam-Checker-Version: SpamAssassin 2.43
        (1.115.2.20-2002-10-15-exp)
Jan  8 18:26:09 enterprise2 sm-mta[27888]: [ID 801593 mail.info] h08HMfof027888:
        Milter delete: header  Subject: hello you         $$$ 33
Jan  8 18:26:09 enterprise2 sm-mta[27888]: [ID 801593 mail.info] h08HMfof027888:
        Milter message: body replaced
===

i would like to hear some comments if this is a bug or not.



since this email (to the spamassassin mailing list) i did an additional test 
with
the spamc tool of spamassassin:
===
address@hidden ~ $ spamc -d 172.27.1.1 -p 3333
Subject: hello you          $$$ 33

PORN SEX MONEY CASH
Subject: *****SPAM***** hello you          $$$ 33
X-Spam-Status: Yes, hits=8.4 required=5.0
        tests=ALL_CAP_PORN,CASHCASHCASH,DATE_MISSING,FROM_MISSING,
              MISSING_HEADERS,SPAM_PHRASE_00_01,SUBJ_HAS_SPACES,
              UPPERCASE_50_75
        version=2.43
X-Spam-Flag: YES
X-Spam-Level: ********
X-Spam-Checker-Version: SpamAssassin 2.43 (1.115.2.20-2002-10-15-exp)

SPAM: ------------------- NewLogic SPAM detector results -------------------
SPAM: This mail is probably spam.
SPAM: 
SPAM: Content analysis details:   (8.40 hits, 5 required)
SPAM: FROM_MISSING       (-0.0 points) Missing From: header
SPAM: SUBJ_HAS_SPACES    (2.6 points)  Subject contains lots of white space
SPAM: DATE_MISSING       (0.8 points)  Missing Date: header
SPAM: ALL_CAP_PORN       (1.2 points)  BODY: Possible porn - in ALL CAPS
SPAM: SPAM_PHRASE_00_01  (0.8 points)  BODY: Spam phrases score is 00 to 01 
(low)
SPAM: MISSING_HEADERS    (1.0 points)  Missing To: header
SPAM: CASHCASHCASH       (1.8 points)  Contains at least 3 dollar signs in a row
SPAM: UPPERCASE_50_75    (0.2 points)  message body is 50-75% uppercase
SPAM: 
SPAM: --------------- End of NewLogic SPAM detector results ----------------

PORN SEX MONEY CASH
===

it seems that spamassassin is right because it gives back the Subject line.
maybe some code in spamass-milter-0.1.3a overreads the first line...

if possible pls also reply directly to: address@hidden

regards, niki
-- 
niki w. waibel - system administrator @ newlogic technologies ag