What is SCC_BODY_URI_ONLY rule in spam assassin?

Question

I am facing this issue SCC_BODY_URI_ONLY with my email when checked with SPAM ASSASSIN, Does anybody know about this rule. There is no great deal of documentation around it.

Answer 1

You are right about the documentation. I checked out https://www.futurequest.net/docs/SA/. A very long list. But still no description. But I did see it had to do with the Meta. So I looked at the source of the email and saw that the title brackets were empty. So I just added a title and bam.... email passed ! Helpful I hope. Rock on..

Answer 2

As of 2022-06-23, the rule works as follows, as defined under 72_active.cf:

meta       SCC_BODY_URI_ONLY      T_SCC_BODY_TEXT_LINE < 2 && __HAS_ANY_URI && !__SMIME_MESSAGE
meta       T_SCC_BODY_TEXT_LINE         __SCC_BODY_TEXT_LINE_FULL - __SCC_SUBJECT_HAS_NON_SPACE
body       __SCC_BODY_TEXT_LINE_FULL    /^\s*\S/
tflags     __SCC_BODY_TEXT_LINE_FULL    multiple maxhits=3
header     __SCC_SUBJECT_HAS_NON_SPACE  Subject =~ /\S/

To summarise, the rule SCC_BODY_URI_ONLY will trigger if:

• T_SCC_BODY_TEXT_LINE returns a number less than 2
  • T_SCC_BODY_TEXT_LINE checks the body of the email for lines containing any non-whitespace character, with any amount of whitespace characters before it, and will run this check a maximum of 3 times. Minus 1 if the Subject contains any non-whitespace characters.
• The email contains any URI
• The email does not have a Content-Type header indicating it is an S/MIME email

So, pretty much any email that contains:

• At least 1 URI, 1 line in the body and a blank subject, OR
• At least 1 URI, 2 lines and a subject with content

The above may be out of date in future, you would have to check the current state of the rules in your Spamassassin definitions. More information can be found about writing/interpreting rules here: https://cwiki.apache.org/confluence/display/SPAMASSASSIN/writingrules