subject line anomaly

[Matthias Andree]

David Relson <relson at osagesoftware.com> writes:

> Happy Thanksgiving to ye all!

Same to you.

Our "Thanksgiving" is earlier here in Germany, our "Erntedank" isn't a
national holiday and depends on the church. The Catholic Church
celebrates (facultatively) Erntedank on the first Sunday of October, the
Protestants reportedly on St. Michael's day (Sept 29) or a Sunday in the
vicinity.

In re of your mail, 

> Subject: Antidote found in Crocodiles
>
>  
> Date: Fri, 26 Nov 2004 00:02:12 +0600
> MIME-Version: 1.0 (appeasableallen kessler cove.3) 
> Content-Type: multipart/alternative;
> 	boundary="--=_fzEmtAW1cFkeL"
> X-Bogosity: Spam, tests=bogofilter, spamicity=1.000000, version=0.93.1
>
>
> This looks a lot like the X-Bogosity line is in the wrong place, doesn't
> it?  Checking on my mail server, I found that the subject line is
> actually:
>
> Subject: Antidote found in Crocodiles^M^M 
>
> (with the last 3 characters being CR, CR, SP).
>
> Conclusion, bogofilter correctly placed the X-Bogosity line using the
> prescribed CRLF, CRLF sequence at the end of the message header, but my
> mail client muffed the CR CR sequence of the Subject line.

the mail client apparently second guessed (wrongly) line endings. In the
physically transported mail, only a CR LF sequence is the line
ending. This is distorted somewhat because most if not all clients
normalize mail line ends to the local line ends, i. e. they collapse CR
LF sequences to a bare LF control character.

> A few days ago, there was a report of bogofilter's occasionally not
> adding the X-Bogosity line to a message.  I wonder if the line might be
> present, but the MUA didn't think it in the header.
>
> Anyhow, I thought y'all might be interested in this unexpected event.

At the time when the passthrough mode was new, I wondered if we would
want to prepend our finding to the head instead, IIRC we had trouble
with mail that had

header
header
...
header
<SP><CR><LF>
body
...

i. e. had a non-blank line (with a space) between the message's header
and body sections.

Mail like you describe violates RFC-2822. The proper way would be to
RFC-2047 the header and encode =?US-ASCII?Q?=0D=0D=20?= (=20 could be _
instead).

Anyways, IMO the mailer misbehaves if treating bare CR as the end of the
header line.

-- 
Matthias Andree