.\" -*- mode: troff; coding: utf-8 -*-
.\" Automatically generated by Pod::Man 5.01 (Pod::Simple 3.43)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" \*(C` and \*(C' are quotes in nroff, nothing in troff, for use with C<>.
.ie n \{\
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
.    if \nF \{\
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{\
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\" ========================================================================
.\"
.IX Title "Mail::SpamAssassin::Plugin::MIMEEval 3pm"
.TH Mail::SpamAssassin::Plugin::MIMEEval 3pm 2024-01-21 "perl v5.38.2" "User Contributed Perl Documentation"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH NAME
Mail::SpamAssassin::Plugin::MIMEEval \- perform various tests against MIME structure and body
.SH SYNOPSIS
.IX Header "SYNOPSIS"
.Vb 1
\&  loadplugin    Mail::SpamAssassin::Plugin::MIMEEval
\&
\&  body NAME_OF_RULE  eval:check_for_mime
\&  body NAME_OF_RULE  eval:check_for_mime_html
\&  body NAME_OF_RULE  eval:check_for_mime_html_only
\&  body NAME_OF_RULE  eval:check_mime_multipart_ratio
\&  body NAME_OF_RULE  eval:check_msg_parse_flags
\&  body NAME_OF_RULE  eval:check_for_ascii_text_illegal
\&  body NAME_OF_RULE  eval:check_abundant_unicode_ratio
\&  body NAME_OF_RULE  eval:check_for_faraway_charset
\&  body NAME_OF_RULE  eval:check_for_uppercase
\&  body NAME_OF_RULE  eval:check_ma_non_text
\&  body NAME_OF_RULE  eval:check_base64_length
\&  body NAME_OF_RULE  eval:check_qp_ratio
.Ve
.SH DESCRIPTION
.IX Header "DESCRIPTION"
Perform various tests against MIME structure and body.
.IP has_check_for_ascii_text_illegal 4
.IX Item "has_check_for_ascii_text_illegal"
Adds capability check for "if \fBcan()\fR" for check_for_ascii_text_illegal
.IP check_for_ascii_text_illegal 4
.IX Item "check_for_ascii_text_illegal"
If a MIME part claims to be text/plain or text/plain;charset=us\-ascii and the Content-Transfer-Encoding is 7bit (either explicitly or by default), then we should enforce the actual text being only TAB, NL, SPACE through TILDE, i.e. all 7bit characters excluding NO-WS-CTL (per RFC\-2822).
.Sp
All mainstream MTA's get this right.
.IP has_check_abundant_unicode_ratio 4
.IX Item "has_check_abundant_unicode_ratio"
Adds capability check for "if \fBcan()\fR" for check_abundant_unicode_ratio
.IP check_abundant_unicode_ratio 4
.IX Item "check_abundant_unicode_ratio"
A MIME part claiming to be text/plain and containing Unicode characters must be encoded as quoted-printable or base64, or use UTF data coding (typically with 8bit encoding).  Any message in 7bit or 8bit encoding containing (HTML) Unicode entities will not render them as Unicode, but literally.
.Sp
Thus a few such sequences might occur on a mailing list of developers discussing such characters, but a message with a high density of such characters is likely spam.
.IP check_for_mime 4
.IX Item "check_for_mime"
Check for various MIME properties.
.Sp
Use in rules such as:
.Sp
.Vb 2
\&  rawbody MIME_BASE64      eval:check_for_mime(\*(Aqmime_base64_count\*(Aq)
\&  describe MIME_BASE64     Includes a base64 attachment
\&
\&  mime_base64_count
\&  mime_base64_encoded_text
\&  mime_body_html_count
\&  mime_body_text_count
\&  mime_faraway_charset
\&  mime_missing_boundary
\&  mime_multipart_alternative
\&  mime_multipart_ratio
\&  mime_qp_count
\&  mime_qp_long_line
\&  mime_qp_ratio
\&  mime_ascii_text_illegal
\&  mime_text_unicode_ratio
.Ve
.IP check_for_mime_html_only 4
.IX Item "check_for_mime_html_only"
Check for messages containing only text/html body parts
.IP has_check_qp_ratio 4
.IX Item "has_check_qp_ratio"
Adds capability check for "if \fBcan()\fR" for check_qp_ratio
.IP check_qp_ratio 4
.IX Item "check_qp_ratio"
Takes a min ratio to use in eval to see if there is an spamminess to the ratio of 
quoted printable to total bytes in an email.