Prepend removing body of message

[EKFletcher]

We have a content filter set up as following:

External_Prepend: if (subject != "\\[EXTERNAL\\]") { edit-header-text("Subject", "(.*)", "[EXTERNAL] \\1"); add-heading("Warning1_Message_Header"); }

It will prepend "[EXTERNAL]" to the subject.  If it's a reply and the prepend is already there it will not add it again.

We also have a text disclaimer that we have built that will add:

** WARNING: This email originated outside of AHS. ** DO NOT CLICK links or attachments unless you recognize the sender and know the content is safe.

...to the top of the body of the message.  However, we're seeing some cases where the body of the message is being completely replaced with the prepend disclaimer.  Almost as if the message has been corrupted by adding the prepend to the top of the body of the message.

Anyone had this happen and know what the solution might be?

Kevin

[Libin Varghese]

An email rewritten by a disclaimer can have issues depending on the encoding of the original email body.

Since the disclaimer has a different encoding to the email body, the exchange may fail to interpret that correctly and end up adding the email body as an attachment.

This is discussed in the below defect:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuy49918/?reffering_site=dumpcr

A few customers have had luck using configuration of "localeconfig" as mentioned in the below article:

https://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118501-qa-esa-00.html

I've seen this happen mostly with encrypted emails where an unencrypted disclaimer is added to the encrypted email body. Modifying the subject would be a better option.

Regards,

Libin Varghese