[bug]: Spam filter is too eager on checking X-Spam flags

[ananace]

What happened?

The spam filter will naively search for the word "yes" in the X-Spam headers, causing emails to be given incorrect spam scores if another spam filter has already applied a spam score using a bayes filter.

Here's a snippet of headers when sending from a Stalwart at home to one at a computer club I'm root for;

...
X-Spam-Result: SPF_ALLOW (-0.2),
	PREVIOUSLY_DELIVERED (0),
	DKIM_SIGNED (0),
	DMARC_POLICY_ALLOW (-0.5),
	DKIM_ALLOW (-0.2),
	TO_MATCH_ENVRCPT_ALL (0),
	FROM_HAS_DN (0),
	ARC_NA (0),
	RCPT_COUNT_ONE (0),
	SPAM_FLAG (5),
	FROM_EQ_ENVFROM (0),
	TO_DN_NONE (0),
	CTE_CASE (0.5),
	RCVD_COUNT_THREE (0),
	SIGNED_PGP (-2),
	RCVD_TLS_LAST (0)
Return-Path: <[email protected]>
Received: from localhost (localhost [127.0.0.1])
	by ste-pvt-msa1.isp.mailout (Postfix) with ESMTP id 293373F827
	for <[email protected]>; Thu,  5 Sep 2024 18:28:54 +0200 (CEST)
X-Virus-Scanned: Debian amavisd-new at isp.mailout
X-Spam-Flag: NO
X-Spam-Score: -2.111
X-Spam-Level:
X-Spam-Status: No, score=-2.111 tagged_above=-999 required=6.31
	tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1,
	DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, NO_RELAYS=-0.001,
	T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
...

Note the SPAM_FLAG (5) score, despite being marked both X-Spam-Flag: NO, X-Spam-Score: -2, and X-Spam-Status: No

How can we reproduce the problem?

Attach a spam-negative X-Spam header that contains the word "bayes" to an incoming mail.

Version

v0.9.x

What database are you using?

PostgreSQL

What blob storage are you using?

S3-compatible

Where is your directory located?

Internal

What operating system are you using?

Docker

Relevant log output

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[mdecimus]

Sending messages with a X-Spam-Flag: No headers is a strategy used by some spammers. If you have a SPAM filter running in front of Stalwart that is adding these headers then simply change the score of the SPAM_FLAG tag to 0.