Sieve interface for spam filtering scripts?

[Pat Lashley]

--On Tuesday, September 30, 2003 21:45:11 +0300 Tuuli K Tuominen 
<tztuomin at cc.helsinki.fi> wrote:

> Hello,
> Does anyone have a simple sieve web interface for creating a filter
> for spam-tagged messages? We'll be tagging spam messages with a
> "X-Spam-Status: Yes" header or somesuch and now I'm looking for an easy
> Sieve interface for creating simple sieve scripts to filter spam-tagged
> messages. At the moment some of our users are using Websieve but I would
> like to offer an easier web form. Does anyone already have one? If there
> is one publicly available, I'd be happy to see it. Otherwise I'll just
> have to make one. :-)

I've recently upgraded my Exim setup to include ExiScan-ACL and
SpamAssassin.  It is configured to add several headers for different
levels of filtering capability.  (The ones I chose were taken from
the examples for ExiSan-ACL and SA; so they should be fairly common.
They differ slightly from the set which SA can be configured to add.)


The X-Spam-Score header contains a floating-point number, which may
include a leading sign, followed by a parenthesized string.  In the
string will be a single slash, or a series of plus or minus signs.
The number of plus or minus signs equals the integer portion of the
spam score.  Thus:

	X-Spam-Score: 12.1 (++++++++++++)

It is very easy for even fairly primitive mail filtering programs
to recognize a number of plus or minus signs.  In Sieve:

	
    if  header :contains [ "X-Spam-Score" ] [ "++++++++++" ] {
        fileinto "INBOX.SPAM.score-10+" ;
    }
    elsif  header :contains [ "X-Spam-Score" ] [ "+++++" ] {
        fileinto "INBOX.SPAM.score-5+" ;
    }
    elsif  header :contains [ "X-Spam-Score" ] [ "-----" ] {
	fileinto "INBOX.HAM.score-5+" ;
    }


I also provide an X-Spam-Score-Int; which is just the spam score multiplied
by 10 to create an integer.  (For filters that can deal with integers but
not floating point.)


And there's an 'X-Spam-Flag: YES' header added if the spam score is over
some site-specified limit.  (But lower than the automatic rejection limit.)


(I also include the SA spam report as a header; which could be used by
more sophisticated filters based on particular tests matched by SA.)



-Pat