/ 
Mail-SpamAssassin-4.0.3-rc1-TRIAL
/ Mail::SpamAssassin::Handler::SVG

NAME

Mail::SpamAssassin::Handler::SVG - A MIME-part handler for image/svg+xml parts

SYNOPSIS

loadhandler  Mail::SpamAssassin::Handler::SVG

svgtext  RULE_NAME  /pattern/modifiers

body  SVG_TEXT_HEAVY  eval:check_svg_text_ratio('5')

DESCRIPTION

SVG is increasingly used as a phishing vector: an image file that is really a text/link canvas, often carrying embedded JavaScript. This handler parses each SVG part and exposes its text content to svgtext rules -- kept separate from HTML body text so the same word (e.g. "docusign") can be scored differently in an SVG than in ordinary HTML.

Links found in the SVG are added to the URI detail list (type svg), and any embedded JavaScript is surfaced for the JavaScript handler -- see "RETURNS". An SVG whose ratio of text words to graphics elements is high -- a mostly-text "image" -- is flagged via the check_svg_text_ratio() eval rule (see "EVAL RULES").

RETURNS

The handler returns any embedded JavaScript found in the SVG as a single { type => 'text/javascript', data => $bytes } sub-part, which the handler framework dispatches to the JavaScript handler (Mail::SpamAssassin::Handler::JavaScript). The script bodies of <script> elements, javascript: URIs, and on* event-handler attributes are joined into that one part. When the SVG contains no script, the handler returns an empty list.

SVG TEXT RULES

svgtext  RULENAME  /regex/modifiers
score    RULENAME  1.0
describe RULENAME  SVG contains text matching /regex/

These rules behave like rawbody rules and support the multiple and maxhits=N tflags.

EVAL RULES

check_svg_text_ratio(MIN_RATIO)

  Fires if any SVG part's ratio of text words to graphics elements
  (image/path/rect/circle/ellipse/line/polyline/polygon/use) is greater than
  or equal to MIN_RATIO.  An SVG that contains text words but no graphics
  element at all is treated as having an infinite ratio and always fires.
  MIN_RATIO defaults to 1.