You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2011/07/22 21:53:01 UTC
[Bug 6637] New: FS_REPLICA and FS_REPLICAWATCH too broad
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6637
Bug #: 6637
Summary: FS_REPLICA and FS_REPLICAWATCH too broad
Product: Spamassassin
Version: 3.3.1
Platform: HP
OS/Version: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Rules
AssignedTo: dev@spamassassin.apache.org
ReportedBy: tony.grobe@gmail.com
Classification: Unclassified
Michael Scheidell suggested on the mailing list that FS_REPLICA and
FS_REPLICAWATCH are too broad and/or overlap. From 72_active.cf:
header FS_REPLICA Subject =~ /replica/i
describe FS_REPLICA Subject says "replica"
header FS_REPLICAWATCH Subject =~ /replica watch/i
describe FS_REPLICAWATCH Subject says Replica watch
David Skoll suggested Subject =~ /\breplica\b/i as a potential improvement for
the first, but I'm unsure what can be done about the overlap. Perhaps a
combination of metas would be an improvement? Something like:
header __FS_REPLICA Subject =~ /\breplica\b/i
header __FS_REPLICAWATCH Subject =~ /replica watch/i
meta FS_REPLICA __FS_REPLICA || __FS_REPLICAWATCH
I'm not sure what legitimate subject would hit both rules, but Mike is right
about the effect of both rules firing on one message:
50_scores.cf:score FS_REPLICA 1.630 3.599 2.028 3.599 # n=2
50_scores.cf:score FS_REPLICAWATCH 3.237 1.715 1.733 3.015 # n=2
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6637] FS_REPLICA and FS_REPLICAWATCH too broad
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6637
John Hardin <jh...@impsec.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |jhardin@impsec.org
--- Comment #1 from John Hardin <jh...@impsec.org> 2011-07-23 17:26:07 UTC ---
Odd, there are a lot of single-word-in-subject tests in that file that _are_
properly \b delimited.
I found a couple of other dangerous undelimited tests in addition to
FS_REPLICA.
Proposed patch, running local masscheck now:
Index: 00_FVGT_File001.cf
===================================================================
--- 00_FVGT_File001.cf (revision 1150163)
+++ 00_FVGT_File001.cf (working copy)
@@ -2400,7 +2400,7 @@
#counts FS_CHEAP_CAP 8s/0h of 47019 corpus (37183s/9836h FVGT)
12/23/06
-header FS_CAILIS Subject =~ /cailis/i
+header FS_CAILIS Subject =~ /\bcailis\b/i
describe FS_CAILIS Subject says cailis
##score FS_CAILIS 10.357
#counts FS_CAILIS 13s/0h of 206859 corpus (199363s/7496h FT)
12/13/05
@@ -2694,7 +2694,8 @@
#counts FS_REFI 8s/0h of 47019 corpus (37183s/9836h FVGT)
12/23/06
-header FS_REPLICA Subject =~ /replica/i
+header __FS_REPLICA Subject =~ /\breplica\b/i
+meta FS_REPLICA __FS_REPLICA && !FS_REPLICAWATCH
describe FS_REPLICA Subject says "replica"
##score FS_REPLICA 0.994
#counts FS_REPLICA 335s/0h of 70341 corpus (31030s/39311h DOC)
12/13/05
@@ -2704,7 +2705,7 @@
#counts FS_REPLICA 92s/0h of 47019 corpus (37183s/9836h FVGT)
12/23/06
-header FS_REPLICAWATCH Subject =~ /replica watch/i
+header FS_REPLICAWATCH Subject =~ /replica watch\b/i
describe FS_REPLICAWATCH Subject says Replica watch
##score FS_REPLICAWATCH 10.357
#counts FS_REPLICAWATCH 110s/0h of 206859 corpus (199363s/7496h FT)
12/13/05
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6637] FS_REPLICA and FS_REPLICAWATCH too broad
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6637
--- Comment #2 from John Hardin <jh...@impsec.org> 2011-07-23 17:46:12 UTC ---
Tests pass.
jhardin@dendarii ~/develop/spamassassin/svn/trunk/rulesrc/sandbox/emailed $ svn
commit -m 'address bug 6637'
Sending emailed/00_FVGT_File001.cf
Transmitting file data .
Committed revision 1150178.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6637] FS_REPLICA and FS_REPLICAWATCH too broad
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6637
John Hardin <jh...@impsec.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |FIXED
--- Comment #3 from John Hardin <jh...@impsec.org> 2011-07-23 17:47:04 UTC ---
Fixed for now.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.