You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2020/08/20 23:26:12 UTC
svn commit: r1881039 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Thu Aug 20 23:26:12 2020
New Revision: 1881039
URL: http://svn.apache.org/viewvc?rev=1881039&view=rev
Log:
Improve detection of invisible HTML text - check <span> as well as <font>
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1881039&r1=1881038&r2=1881039&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Thu Aug 20 23:26:12 2020
@@ -2268,11 +2268,11 @@ endif
# rawbody __SPAN_INVIS /<span\s[^>]{0,200}style\s*=\s*"[^">]{0,80}(?:visibility\s*:\s*hidden\s*;|display\s*:\s*none\s*;)[^>]{1,200}>\w/i
if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
- rawbody __FONT_INVIS /<font\s[^>]{1,80}(?:font-size\s*:\s*(?:[01](?:px|pt|Q|vw|vh|vmin)|0(?:cm|mm|in|pc|em|ex|ch|rem|lh|vmax))\s*[;']|color\s*:\s*transparent\s*[;'])[^>]{0,80}>/i
+ rawbody __FONT_INVIS /<(?:font|span)\s[^>]{1,80}(?:font-size\s*:\s*(?:[01](?:px|pt|Q|vw|vh|vmin)|0(?:cm|mm|in|pc|em|ex|ch|rem|lh|vmax))\s*[;']|color\s*:\s*transparent\s*[;'])[^>]{0,80}>/i
tflags __FONT_INVIS multiple maxhits=6
meta __FONT_INVIS_MANY __FONT_INVIS > 5
meta HTML_TEXT_INVISIBLE_FONT __FONT_INVIS_MANY
- describe HTML_TEXT_INVISIBLE_FONT HTML hidden text, typically for word obfuscation
+ describe HTML_TEXT_INVISIBLE_FONT HTML hidden text - word obfuscation?
score HTML_TEXT_INVISIBLE_FONT 3.000 # limit
tflags HTML_TEXT_INVISIBLE_FONT publish
endif