search

friedPotat0 / Spam-Scores

Thunderbird add-on to display spam scores according to mail headers. Supports spam/ham score headers of Rspamd and SpamAssassin. The add-on adds a column with the overall spam score to the mail list view and shows details of any matched spam/ham rule.
https://addons.thunderbird.net/de/thunderbird/addon/spam-scores/
Other
42 stars 6 forks source link

Duplicates in score list #48

Closed PitWenkin closed 2 months ago

PitWenkin commented 2 years ago

Describe the bug Some (most/all) individual scores are listes twice in the detailed list. Sometimes even with different scores In the example: RCVD_IN_PBL is listed with 3.3as well as 0 DATE_IN_PAST_03_06 is listed with 1.6as well as 0 BAYES_00 is listed with -1.9as well as 0

T_SCC_BODY_TEXT_LINE is listed with and without description

Expected behavior Each score should only be listed once, with the right score

Screenshots 1 2

Thunderbird (please complete the following information):

Spam Score add-on (please complete the following information):

Additional context

Source:

X-Spam-Level: *
X-Spam-Status: No, score=1.7 required=5.0 tests=BAYES_00,BITCOIN_ONAN,
    BITCOIN_SPAM_02,DATE_IN_PAST_03_06,PDS_BTC_ID,RCVD_IN_DNSWL_HI,
    RCVD_IN_PBL,RCVD_IN_SORBS_DUL,RCVD_IN_VALIDITY_RPBL,RCVD_IN_XBL,
    RDNS_NONE,SPF_FAIL,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED
    autolearn=no autolearn_force=no version=3.4.2
X-Spam-Report: 
    *  0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was
    *      blocked.  See
    *      http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
    *      for more information.
    *      [URIs: olefa.com]
    *  3.3 RCVD_IN_PBL RBL: Received via a relay in Spamhaus PBL
    *      [186.82.84.17 listed in zen.spamhaus.org]
    *  0.4 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
    * -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
    *      [score: 0.0000]
    *  1.3 RCVD_IN_VALIDITY_RPBL RBL: Relay in Validity RPBL,
    *      https://senderscore.org/blocklistlookup/
    *      [186.82.84.17 listed in bl.score.senderscore.com]
    * -5.0 RCVD_IN_DNSWL_HI RBL: Sender listed at https://www.dnswl.org/,
    *      high trust
    *      [186.82.84.17 listed in list.dnswl.org]
    *  0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record
    *  1.6 DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date
    *  0.0 SPF_FAIL SPF: sender does not match SPF record (fail)
    *      [SPF failed: Please see http://www.openspf.org/Why?s=mfrom;id=info%40olefa.com;ip=186.82.84.17;r=s1.educdesign.lu]
    *  0.0 RCVD_IN_SORBS_DUL RBL: SORBS: sent directly from dynamic IP
    *      address
    *      [186.82.84.17 listed in dnsbl.sorbs.net]
    *  0.8 RDNS_NONE Delivered to internal network by a host with no rDNS
    * -0.0 T_SCC_BODY_TEXT_LINE No description available.
    *  0.0 PDS_BTC_ID FP reduced Bitcoin ID
    *  0.2 BITCOIN_SPAM_02 BitCoin spam pattern 02
    *  1.0 BITCOIN_ONAN BitCoin + [censored]

Headers as they are displayed by Thunderbird: Thunderbird headers display

Might be regex having problems with something in the description, e.g. + in BITCOIN_ONAN?

friedPotat0 commented 2 years ago

Thanks for reporting! It looks like the X-Spam-Status and the X-Spam-Report header are both being parsed. The X-Spam-Status header however has no detailed information so additional zero scores are added to the list. I will check the priority of the headers and report back when the issue is fixed...

Maybe it is time to implement a custom priority that can be adjusted in the add-on settings as mentioned in #7.

PitWenkin commented 2 years ago

You might be right. Until a week ago I only hat the X-Spam-Status, which was propperly parsed, but hat 0 for each score in the popup. The duplicates (with the right scores on half of them) only showed up after I enabled the X-Spam-Report too.

I could propably fix it this by removing the tests form the X-Spam-Status …

nairobiny commented 1 year ago

This bug is still there. I'd rather not turn off the X-Spam-Status header, because it contains information that isn't elsewhere.