1# IMAP filters23Most storage backends support application of custom code late in delivery4process. As opposed to using SMTP pipeline modifiers or checks, it allows5modifying IMAP-specific message attributes. In particular, it allows6code to change target folder and add IMAP flags (keywords) to the message.78There is no way to reject message using IMAP filters, this should be done9earlier in SMTP pipeline logic. Quarantined messages are not processed10by IMAP filters and are unconditionally delivered to Junk folder (or other11folder with \Junk special-use attribute).1213To use an IMAP filter, specify it in the 'imap\_filter' directive for the14used storage backend, like this:15```16storage.imapsql local_mailboxes {17 ...1819 imap_filter {20 command /etc/maddy/sieve.sh {account_name}21 }22}23```2425## System command filter (imap.filter.command)2627This filter is similar to check.command module28and runs a system command to obtain necessary information.2930Usage:31```32command executable_name args... { }33```3435Same as check.command, following placeholders are supported for command36arguments: {source\_ip}, {source\_host}, {source\_rdns}, {msg\_id}, {auth\_user},37{sender}. Note: placeholders38in command name are not processed to avoid possible command injection attacks.3940Additionally, for imap.filter.command, {account\_name} placeholder is replaced41with effective IMAP account name, {rcpt_to}, {original_rcpt_to} provide42access to the SMTP envelope recipient (before and after any rewrites),43{subject} is replaced with the Subject header, if it is present.4445Note that if you use provided systemd units on Linux, maddy executable is46sandboxed - all commands will be executed with heavily restricted filesystem47access and other privileges. Notably, /tmp is isolated and all directories48except for /var/lib/maddy and /run/maddy are read-only. You will need to modify49systemd unit if your command needs more privileges.5051Command output should consist of zero or more lines. First one, if non-empty, overrides52destination folder. All other lines contain additional IMAP flags to add53to the message. If command wants to add flags without changing folder - first54line should be empty.5556It is valid for command to not write anything to stdout. In this case its57execution will have no effect on delivery.5859Output example:60```61Junk62```63In this case, message will be placed in the Junk folder.6465```6667$Label168```69In this case, message will be placed in inbox and will have70'$Label1' added.