/ 
Mail-SpamAssassin-4.0.3-rc1-TRIAL
/ Mail::SpamAssassin::Handler::ICS

NAME

Mail::SpamAssassin::Handler::ICS - A MIME-part handler for text/calendar parts

SYNOPSIS

loadhandler  Mail::SpamAssassin::Handler::ICS

icstext  RULE_NAME  /pattern/modifiers

body  ICS_MANY_ATTENDEES  eval:check_ics_attendee_count('50')
body  ICS_RANDOM_DTSTART  eval:check_ics_random_start_time()

DESCRIPTION

This handler parses each iCalendar part and renders the text of every event's SUMMARY and DESCRIPTION into the message body, so ordinary body rules can match it. The same text can additionally be matched with the new icstext rule type, which sees the invite text on its own -- so a word can be scored differently inside an invite than in the surrounding body. Links found in the URL, ATTACH and LOCATION properties are added to the URI detail list (type ics). It also counts ATTENDEE properties and flags events whose DTSTART has a non-zero seconds component (a fingerprint of machine-generated / bulk invites, since human and most-client invites round to :00) -- see "EVAL RULES".

RETURNS

This handler returns one text/html sub-part for each HTML-typed property found, or an empty list if there are none.

ICS TEXT RULES

icstext  RULENAME  /regex/modifiers
score    RULENAME  1.0
describe RULENAME  ICS event text matching /regex/

These rules behave like rawbody rules and support the multiple and maxhits=N tflags. By default a rule stops at its first match. icstext matches only the invite text; to run one of the eval rules below, use a body rule.

EVAL RULES

check_ics_attendee_count(MIN, [MAX])

  body RULENAME  eval:check_ics_attendee_count(<min>,[max])
     min: required, invites contain at least x ATTENDEE properties in total
     max: optional, if specified, must not contain more than x ATTENDEE properties

check_ics_random_start_time()

  body RULENAME  eval:check_ics_random_start_time()

     Fires if any event's DTSTART has a non-zero seconds component
     (e.g. DTSTART:20250610T120005Z) -- a fingerprint of a machine-generated
     start time, since human and most-client invites round to whole minutes.

check_ics_event_prop(NAME, REGEX)

  body RULENAME  eval:check_ics_event_prop('ATTACH', 'ENCODING=BASE64')

     Fires if any calendar event has a property named NAME (case-insensitive)
     whose content matches REGEX.  The leading property NAME is stripped -- REGEX
     sees "params:value" (or just "value" when the property has no parameters) --
     so a rule for the DESCRIPTION value need not skip past a "DESCRIPTION:"
     prefix.  REGEX is a regular expression; the surrounding /.../ delimiters are
     optional, so 'ENCODING=BASE64' and '/ENCODING=BASE64/' are equivalent -- use
     the delimited form when you need flags (e.g. '/foo/i').  Note that even
     without delimiters it is still a regex, not a literal substring:
     metacharacters such as . | ( ) are active.  Because the parameters are
     retained, REGEX can still match them as well as the value -- e.g.
     ENCODING=BASE64, VALUE=BINARY, FMTTYPE=image/png.  Useful for finding
     invites that carry inline attachments or images.

URI DETAILS

This handler creates a new "ics" URI type. You can detect URIs found in calendar invites using the URIDetail plugin. For example:

uri-detail RULENAME  type =~ /^ics$/  raw =~ /^https?:\/\/bit\.ly\//