How can I create a filter to remove Base64 content

[UweHofmann]

Hi Team,

how can I create a filter or rule to check incoming mails from a specific domain and remove this embedded picture and replace it with "Image removed"
<img src=3D"data:ima=ge/jpeg;base64,/9j/4AAQSkZJRgABAQEB.....: 385px; height: 170px;">

Any help would be appreciated

Many Thanks
Uwe

 

[Badej]

Regarding replacement,
I can't recommend anything. You could try the SpamAssassin rule. Add a +5 if it finds Base64 in the IMG tag.

body      LOCAL_BASE64_IMG     /<img[^>]+src(?:=|=3D)["']?\s*data:\s*i\s*=?\s*m\s*=?\s*a\s*=?\s*g\s*=?\s*e\s*\/[a-zA-Z0-9.+_-]+;\s*base64\s*,/i
describe  LOCAL_BASE64_IMG     Message contains inline base64 image
score     LOCAL_BASE64_IMG     5.0
tflags    LOCAL_BASE64_IMG     noautolearn