0

Environment: cPanel/WHM using Exim 4.91.

I noticed that our "Global Email Filters" (cPanel parlance) weren't working correctly on emails sent by certain ISPs.

To make a long story short, I discovered that email headers that incorrectly use newlines are causing the filtering to not work correctly. Some examples are below.


Filter works

X-Custom-Header: allOneLine
To: "filtertest@example.com" <filtertest@example.com>

This message IS correctly filtered by Exim.

Filter does not work

X-Custom-Header: line1
line2
To: "filtertest@example.com" <filtertest@example.com>

This message is NOT correctly filtered by Exim due to the newline in X-Custom-Header that is not followed immediately by whitespace.

Filter works

To: "filtertest@example.com" <filtertest@example.com>
X-Custom-Header: line1
line2

This message IS correctly filtered by Exim. There is an invalid newline in the X-Custom-Header, but the To filter precedes the newline, so filtering succeeds.

Filter works

X-Custom-Header: line1
 line2
To: "filtertest@example.com" <filtertest@example.com>

This message IS correctly filtered by Exim. Although there is a newline in X-Custom-Header, the subsequent line begins with whitespace.

I've reviewed the actual Exim filters that cPanel creates in /etc/vfilters/example.com, and I don't see any obvious problems. So, it seems that this may be a bug in Exim. If a header contains a newline that is not followed immediately by whitespace, filtering will not be performed on subsequent headers.

I do understand that using a newline that is not followed by whitespace is syntactically invalid (RFC 2822; search for "folding"). The problem is that we obviously don't have control over other senders' headers. It seems that legitimate senders are guilty of committing this sin. Yahoo, for example, includes an "Outgoing Spam Guard" header (X-YMail-OSG) that contains newlines not followed by whitespace.

Does this indeed appear to be a bug in Exim?

What are the potential workarounds?

  • Exim does it completely right, the headers are wrong. I guess that's rather a cPanel configuration issue, and should be tagged as such. – grin Jan 11 at 10:52
  • Thanks for your feedback, @grin! I think that conclusion is a bit premature. The issue presents itself regardless of the complexity of the filters that cPanel creates. In fact, we would expect to experience the issue even on hand-written Exim filters. Perhaps you're rather referring to some sort of configuration issue in our exim.conf? Do you have any suggestions on which settings we should investigate? – rinogo Jan 23 at 1:39
  • Exim (and I guess others, too, but I haven't checked) takes a bareword in the header (no whitespace at the beginning and colon after) as EndOfHeader and what follows become the mail body. I don't readily see how this could (or should) be worked around. It's not just filtering: the mail will be received as if the headers following were part of the body, ignoring the "headers which became body" as you probably should have noticed. – grin Feb 14 at 12:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.