Matching Spam header via user sieve script (managesieve)

[pdf]

Issue Description

#1917 was added to allow fileinto to succeed even when emails are marked as spam. As a result, in order to correctly file spam messages that would otherwise be filed to a non-standard folder, a user sieve rule is required to match spam headers.

Having added such a rule at the top of a user sieve script, however, matching emails are not filed into junk.

Expected Behavior

Given the following sieve script:

require ["imap4flags","fileinto","regex"];
if allof (header :contains "X-Spam-Status" "Yes") {
    addflag "Junk";
    fileinto "Spam";
    stop;
}
if allof (address :contains ["to", "cc"] "jobs@") {
    fileinto "INBOX/Jobs";
    stop;
}
...

And the following mail headers:

X-Spam-Status: Yes
X-Spam-Result: DKIM_ALLOW (-0.20),
	SPF_ALLOW (-0.20),
	ARC_NA (0.00),
	DBL_BLOCKED_OPENRESOLVER (0.00),
	DKIM_SIGNED (0.00),
	DNSWL_BLOCKED (0.00),
	DWL_DNSWL_BLOCKED (0.00),
	FREEMAIL_REPLY_TO (0.00),
	FROM_EQ_ENV_FROM (0.00),
	FROM_HAS_DN (0.00),
	HAS_REPLYTO (0.00),
	HTML_SHORT_1 (0.00),
	PREVIOUSLY_DELIVERED (0.00),
	RBL_SPAMHAUS_BLOCKED_OPENRESOLVER (0.00),
	RCPT_COUNT_ONE (0.00),
	RCPT_IN_BODY (0.00),
	RCVD_COUNT_ONE (0.00),
	RCVD_TLS_LAST (0.00),
	REPLYTO_DOM_NEQ_FROM_DOM (0.00),
	SOURCE_ASN_15169 (0.00),
	SUBJECT_ENDS_EXCLAIM (0.00),
	TO_DN_NONE (0.00),
	TO_MATCH_ENVRCPT_ALL (0.00),
	URIBL_BLOCKED (0.00),
	MIME_BASE64_TEXT (0.10),
	DMARC_NA (1.00),
	PARTS_DIFFER (1.00),
	FREEMAIL_REPLY_TO_NEQ_FROM_DOM (3.00),
	SPOOF_REPLYTO (6.00)
X-Spam-Score: spam, score=10.70
To: jobs@example.com

I would expect this email to be filed into Spam (which is configured as my Junk folder in Stalwart).

Actual Behavior

Message in the above example is filed into Inbox/Jobs

Reproduction Steps

1. Have sieve rule that would result in message being filed into non-standard folder
2. Add sieve rule preceeding (1) to file Spam messages into junk folder
3. Receive mail tagged with spam headers
4. Mail is filed into (1) instead of (2)

Relevant Log Output

Hard to capture relevant logs as this would require long-term trace-level until a spam message happens to come in, but even at trace level I could not see any logs related to sieve script evaluation, so I think trace logs would just show which folder it was filed into, which we already know?

Stalwart Version

v0.15.x

Installation Method

Docker

Database Backend

RocksDB

Blob Storage

S3-compatible

Search Engine

Internal

Directory Backend

LDAP

Additional Context

No response

I acknowledge that:

• I have reviewed the documentation and FAQ and confirm that my issue is NOT addressed there.
• I have searched the Stalwart repository (both open and closed Discussions and Issues) and confirm this is not a duplicate.
• I have set the logging level to trace and included relevant log output if applicable.
• I agree to follow the project's Code of Conduct.

[mdecimus]

The X-Spam-Status header is not available to user sieve scripts as it is added at the end of processing, you can use X-Spam-Score instead. Also the code below is not necessary as Stalwart already moves to Junk all emails classified as spam.

if allof (header :contains "X-Spam-Status" "Yes") {
    addflag "Junk";
    fileinto "Spam";
    stop;
}

[pdf]

The reason this rule is necessary is due to #1917 - Stalwart explicitly doesn't move spam emails to junk if they would otherwise be moved to a different folder by sieve.

Is there a technical reason that all headers are not available by the time sieve user scripts run?

[mdecimus]

Is there a technical reason that all headers are not available by the time sieve user scripts run?

To avoid rebuilding the message each time a filter runs.

The last commit now allows the spam test extension to be used to check the final result of the spam classifier.

           require ["spamtest", "fileinto", "relational", "comparator-
                    i;ascii-numeric"];

           if spamtest :value "eq" :comparator "i;ascii-numeric" "1"
           {
               fileinto "INBOX";
           }
           elsif spamtest :value "eq" :comparator "i;ascii-numeric" "10"
           {
               fileinto "Spam";
           }

[pdf]

That should be workable, though it's unfortunate there's no way to make this behaviour the default as many users still expect spam to be filed as such, regardless of whatever other rules might be in place, as this is how things work on many email hosts.

Coming from Dovecot, the mechanism provided there for administrative filters is via a global sieve script that is prepended to the user script during local delivery. If a similar mechanism was implemented in Stalwart, with default content that performs only the fileinto spam operation (with folder name substitution based on configured junk folder somehow, and probably defaulting to stop), then the explicit Stalwart spam filing rust code could be dropped, and behaviour left up to administrators if they wish to allow fileinto to override spam filing by removing the stop step from the sieve script.

Example default sieve global script:

           require ["spamtest", "fileinto", "relational", "comparator-i;ascii-numeric"];

           if spamtest :value "eq" :comparator "i;ascii-numeric" "10"
           {
               fileinto "<substitute junk folder here>";
               stop;
           }

[mdecimus]

Just to clarify, the spam filter does work with Sieve scripts and there is no need to add a global script to move messages to the junk folder. However, if you use the fileinto command on a junk email you are telling Stalwart that you want to override the spam filter's classification.

[pdf]

In general I'd say that it's expected that spam email is always filed as spam with preference over any other filing that might take place - this is how most mail hosts work IME, and currently AFAICT there's no way to restore that as the default behaviour in Stalwart.