Scroll to navigation

Mail::SpamAssassin::Plugin::Redirectors(3pm) User Contributed Perl Documentation Mail::SpamAssassin::Plugin::Redirectors(3pm)

NAME

Redirectors - Check for redirected and shortened URLs

SYNOPSIS

  loadplugin    Mail::SpamAssassin::Plugin::Redirectors
  url_redirector bing.com
  url_shortener tinyurl.com
  body HAS_REDIR_URL          eval:redir_url()
  describe HAS_REDIR_URL      Message has one or more redirected URLs
  body REDIR_URL_VALID        eval:redir_url_valid()
  describe REDIR_URL_VALID    Message has a redirector that returned a valid redirection
  body REDIR_URL_CHAINED      eval:redir_url_chained()
  describe REDIR_URL_CHAINED  Message has redirected URL chained to other redirectors
  body REDIR_URL_CHAINED_DOM      eval:redir_url_chained_domain()
  describe REDIR_URL_CHAINED_DOM  Message has redirected URL chained to another redirector on the same domain
  body REDIR_URL_MAXCHAIN     eval:redir_url_maxchain()
  describe REDIR_URL_MAXCHAIN Message has redirected URL that causes too many redirections
  body REDIR_URL_LOOP         eval:redir_url_loop()
  describe REDIR_URL_LOOP     Message has redirected URL that loops back to itself
  body REDIR_URL_404          eval:redir_url_code('404') # Can check any non-redirect HTTP code
  describe REDIR_URL_404      Message has redirected URL returning HTTP 404
  body HAS_SHORT_URL          eval:short_url()
  describe HAS_SHORT_URL      Message has one or more shortened URLs
  body SHORT_URL_REDIR        eval:short_url_redir()
  describe SHORT_URL_REDIR    Message has shortened URL that resulted in a valid redirection
  body SHORT_URL_CHAINED      eval:short_url_chained()
  describe SHORT_URL_CHAINED  Message has shortened URL chained to other shorteners
  body SHORT_URL_MAXCHAIN     eval:short_url_maxchain()
  describe SHORT_URL_MAXCHAIN Message has shortened URL that causes too many redirections
  body SHORT_URL_LOOP         eval:short_url_loop()
  describe SHORT_URL_LOOP     Message has short URL that loops back to itself
  body SHORT_URL_200          eval:short_url_code('200') # Can check any non-redirect HTTP code
  describe SHORT_URL_200      Message has shortened URL returning HTTP 200
  body SHORT_URL_404          eval:short_url_code('404') # Can check any non-redirect HTTP code
  describe SHORT_URL_404      Message has shortened URL returning HTTP 404
  uri URI_TINYURL_BLOCKED      m,https://tinyurl\.com/app/nospam,
  describe URI_TINYURL_BLOCKED Message contains a tinyurl that has been disabled due to abuse
  uri URI_BITLY_BLOCKED       m,^https://bitly\.com/a/blocked,
  describe URI_BITLY_BLOCKED  Message contains a bit.ly URL that has been disabled due to abuse

DESCRIPTION

This plugin looks for URLs redirected or shortened by a list of URL redirector/shortener services. Upon finding a matching URL, plugin will send a HTTP request to the service and retrieve the Location-header which points to the actual destination URL. It then adds this URL to the list of URIs extracted by SpamAssassin which can then be accessed by uri rules and plugins such as URIDNSBL.

This plugin will follow chained redirections, where a redirected URL leads to another redirector, in any combination and order -- for example a redirector that unwraps into what used to be called a "shortener", or vice versa. There is no functional difference between a "redirector" and a "shortener": both are just a domain whose HTTP response redirects somewhere else, and both are followed by the same code path. "url_shortener"/"url_shortener_get"/"url_shortener_custom_user_agent" and their "max_short_url*"/"url_shortener_cache_*"/etc. settings are kept as deprecated aliases of "url_redirector"/"url_redirector_get"/etc. for backwards compatibility, and are planned for removal in a future version. Likewise, short_url() and its sibling eval rules are aliases of redir_url() and friends. Redirection depth is limited by "max_redir_url_redirections", and "max_redir_urls" redirector URLs are checked in a message (10 by default); setting it to 0 disables HTTP requests, allowing only redir_url() to work and report found redirectors.

All supported rule types for checking redirected URLs and redirection status are documented in SYNOPSIS section.

NOTES

This plugin runs before priority 0 so that it may modify the parsed URI list prior to normal uri rules or the URIDNSBL plugin.

ACKNOWLEDGEMENTS

The url_shortener functionality was originally provided by a separate DecodeShortURLs plugin; that functionality has been merged into this one, and "Mail::SpamAssassin::Plugin::DecodeShortURLs" is now a deprecated compatibility shim that loads this plugin.

USER SETTINGS

Domains that should be considered as a URL redirector.

Domain matching:

  • A bare domain (e.g. "bing.com") matches that exact host and also "www.bing.com".
  • A leading dot (e.g. ".sendgrid.com") matches any subdomain of the domain, to any depth. It does NOT match the bare domain itself; to match both, also list the bare domain ("sendgrid.com").

An optional "/path" may follow the domain to restrict matching to URLs whose path begins with that string and ends at a path-segment boundary. "/tr/op" matches "/tr/op", "/tr/op/foo", and "/tr/op?x=1", but NOT "/tr/open" -- the configured prefix is treated as one or more whole path segments. Append a trailing slash ("/tr/op/") to require at least one more segment after it (matches "/tr/op/foo" but not bare "/tr/op"). Multiple entries for the same domain are additive (allowlist); a URL is followed if it matches any entry.

A bare-domain entry without a path is equivalent to "domain/", which matches any path.

Example:

 url_redirector bing.com
 url_redirector .sendgrid.com
 url_redirector .sendibt2.com/tr/cl/

The last line follows "https://x.y.sendibt2.com/tr/cl/abc" but not "https://x.y.sendibt2.com/tr/op/abc".

"url_shortener" (and "url_shortener_get", "clear_url_shortener") are deprecated aliases of "url_redirector" (and "url_redirector_get", "clear_url_redirector") kept for backwards compatibility with configs written for the old DecodeShortURLs plugin, there is no functional difference between the two names, and the "url_shortener*" spelling is planned for removal in a future version.

Enables the Selenium subsystem. When set to 1, hosts listed in "url_redirector_selenium" are fetched using Selenium (headless Chrome). When 0 (the default), those hosts are skipped entirely -- there is no fallback to LWP, because hosts only belong in "url_redirector_selenium" if their redirects cannot be discovered via LWP (e.g., JavaScript-driven redirects).

This is a runtime kill switch: an operator can disable the Selenium subsystem without editing the host allowlist. While it is off, those hosts are simply not probed -- redir_url() still fires for them so detection rules continue to work.

Due to how Selenium works, redir_url_code() and "redir_url_404" subs will not fire for hosts handled by Selenium; Selenium reports only "redirected" (301) or "not a redirect" (200), not real HTTP status codes.

Set Selenium host to use.
Set Selenium port to use.
Clear configured url_redirector/url_shortener domains, for example to override default settings from an update channel. If no arguments are given, all entries are cleared. If domains are specified, only those are removed.

When an entry includes a "/path", only that path is removed from the domain's allowlist; the domain entry itself is dropped only when its path list becomes empty. Use "domain/" to remove the "match any path" entry added by a bare-domain configuration.

Domains that should be considered as an URL redirector, accessed using the HTTP GET method instead of HEAD. Syntax and matching rules are the same as "url_redirector": a bare domain matches that host and "www.", a leading dot matches the domain and any subdomain, and an optional "/path" prefix restricts the match.
Domains that should be fetched using Selenium (headless Chrome) instead of LWP. Use this only for hosts whose redirects are NOT discoverable via LWP, such as JavaScript-driven redirects. Syntax and matching rules are the same as "url_redirector".

Selenium executes JavaScript on the destination and always sends GET, which has weaker safety properties than the LWP path; reserve this list for hosts that genuinely require browser-driven redirect unwrapping.

If the same host appears in both "url_redirector_selenium" and "url_redirector"/"url_redirector_get", the directive parsed last sets the method, and a warning is emitted.

The Selenium subsystem is gated by "url_redirector_use_selenium". When that flag is off, hosts in this list are skipped entirely (there is no fallback to LWP, since these hosts wouldn't yield useful results via LWP).

Domains that, when found as a redirect destination, should cause the redirect chain to stop immediately. Useful to break loops caused by consent or gateway pages that redirect back into the chain.

Example:

 url_skip_redirect_to consent.google.com
Clear configured url_skip_redirect_to domains. If domains are specified, only those are removed from the list.
Regexp used to parse uri parameters in order to detect redirectors and to get redirected domains. The regexp must match only the redirected domain.
Custom HTTP user-agent to be used for specific domains, instead of the default specified in "url_redirector_user_agent". Required for some services like t.co to return blocked URL correctly.

Example:

 url_redirector_custom_user_agent t.co curl/8.6.0

PRIVILEGED SETTINGS

The cache type that is being utilized. Currently only supported value is "dbi" that implies "url_redirector_cache_dsn" is a DBI connect string. DBI module is required.

Example: url_redirector_cache_type dbi

The DBI dsn of the database to use.

For SQLite, the database will be created automatically if it does not already exist, the supplied path and file must be read/writable by the user running spamassassin or spamd.

For MySQL/MariaDB or PostgreSQL, see sql-directory for database table creation clauses.

You will need to have the proper DBI module for your database. For example DBD::SQLite, DBD::mysql, DBD::MariaDB or DBD::Pg.

Minimum required SQLite version is 3.24.0 (available from DBD::SQLite 1.59_01).

Examples:

 url_redirector_cache_dsn dbi:SQLite:dbname=/var/lib/spamassassin/Redirectors.db

A config that still loads the deprecated "DecodeShortURLs" plugin (rather than loading "Redirectors" directly) keeps using that plugin's original "short_url_cache" table/columns, so an existing cache built before the plugins were merged keeps working unchanged. Switching "loadplugin" to "Redirectors" starts a fresh "redir_url_cache" table, as a one-time cost of migrating.

The username that should be used to connect to the database. Not used for SQLite.
The password that should be used to connect to the database. Not used for SQLite.
The length of time a cache entry will be valid for in seconds. Default is 86400 (1 day).

See "url_redirector_cache_autoclean" for database cleaning.

Deprecated alias of "url_redirector_cache_type" -- there is only one cache now, shared by everything this plugin fetches (redirectors and shorteners alike).
Deprecated alias of "url_redirector_cache_dsn".
Deprecated alias of "url_redirector_cache_username".
Deprecated alias of "url_redirector_cache_password".
Deprecated alias of "url_redirector_cache_ttl".

See "url_redirector_cache_autoclean" for database cleaning.

ADMINISTRATOR SETTINGS

Automatically purge old entries from database. Value describes a random run chance of 1/x. The default value of 1000 means that cleaning is run approximately once for every 1000 messages processed. Value of 1 would mean database is cleaned every time a message is processed.

Set 0 to disable automatic cleaning and to do it manually.

If this option is enabled (set to 1), then redirected URLs and the decoded URLs will be logged with info priority.
Maximum time a redirection URL HTTP request can take, in seconds.
Maximum amount of redirector URLs that will be looked up per message. Chained redirections are not counted, only initial redirection URLs found.

Setting it to 0 disables HTTP requests, allowing only redir_url() test to work and report any found redirector URLs.

Maximum depth of chained redirections that a redirector can generate.
Set User-Agent header for HTTP requests. Some services require it to look like a common browser.
Deprecated alias of "url_redirector_cache_autoclean".
Deprecated alias of "url_redirector_loginfo".
Deprecated alias of "url_redirector_timeout".
Deprecated alias of "max_redir_urls" -- there is only one budget now, shared by everything this plugin fetches (redirectors and shorteners alike).
Deprecated alias of "max_redir_url_redirections".
Deprecated alias of "url_redirector_user_agent". Per-domain overrides use "url_redirector_custom_user_agent" ("url_shortener_custom_user_agent" is itself a deprecated alias of that).
2026-10-14 perl v5.42.3