#2 Open redirector checking misses "Refresh"

[Nick Leverton]

Received a spam this morning, using Geocities sites redirecting
with "Meta http-equiv=Refresh to the spamsite. I'll attach the
spam and the current contents of the site. I checked with SA
2.64 + SpamCopURI 0.22, and with Spamassassin 3.0.0, and
both versions miss this form of redirection. I can see the request
for the Geocities URL, and the response coming back, so the
open redirect check is happening - it just misses this way of
doing it.

The 2.64 options I used are
spamcop_uri_resolve_open_redirects 1
open_redirect_list_spamcop_uri geocities.com

can't see any options for SA3.0 affecting this.

[Nick Leverton]

Plaintext geocities redirector spam

[Nick Leverton]

The HTML returned from Geocities