You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2019/07/21 01:43:27 UTC
svn commit: r1863512 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Sun Jul 21 01:43:27 2019
New Revision: 1863512
URL: http://svn.apache.org/viewvc?rev=1863512&view=rev
Log:
FP Avoidance tuning, add some test rules suggested by Amir Caspi
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1863512&r1=1863511&r2=1863512&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Sun Jul 21 01:43:27 2019
@@ -1320,10 +1320,10 @@ uri __URI_WWW_MC m,://(?
uri __URI_TLD_MC /\.(?!(?-i:com|net|org|biz|info|COM|NET|ORG))(?:com|net|org|biz|info)\b/i
uri __URI_GOOG_MC /(?!(?-i:[Gg]oogle))google/i
-rawbody __HTML_FONT_TINY_01 /font-size:\s{0,5}[0-4]px;/i
-meta HTML_FONT_TINY __HTML_FONT_TINY_01 && __TAG_EXISTS_BODY && !__DKIM_EXISTS && !__BUGGED_IMG && !__VIA_ML && !__RP_MATCHES_RCVD && !__THREADED && !__LCL__ENV_AND_HDR_FROM_MATCH && !__MSGID_JAVAMAIL && !__FROM_LOWER && !__HAS_THREAD_INDEX && !__FROM_LOWER
-describe HTML_FONT_TINY Font too small to read
-score HTML_FONT_TINY 1.500 # limit
+rawbody __HTML_FONT_TINY_01 /font-size:\s{0,5}[0-4]px;/i
+meta HTML_FONT_TINY_NORDNS __HTML_FONT_TINY_01 && __RDNS_NONE
+describe HTML_FONT_TINY_NORDNS Font too small to read, no rDNS
+score HTML_FONT_TINY_NORDNS 1.500 # limit
body __BODY_TEXT_LINE /^\s*\S/
tflags __BODY_TEXT_LINE multiple maxhits=3
@@ -2720,7 +2720,7 @@ meta URI_GIBB_NO_PROTO _
score URI_GIBB_NO_PROTO 3.000 # limit
describe URI_GIBB_NO_PROTO Long, gibberish, no-protocol URI
-
+# test rules suggested by Amir Caspi
header __AC_FROM_MANY_DOTS From =~ /<(?:\w{2,}\.){2,}\w+@/
meta __AC_FROM_MANY_DOTS_MINFP __AC_FROM_MANY_DOTS && !ALL_TRUSTED && !FREEMAIL_FORGED_FROMDOMAIN && !FORGED_GMAIL_RCVD && !__UNSUB_LINK && !__XM_VBULLETIN && !__RDNS_SHORT && !__REPTO_QUOTE && !__FSL_RELAY_GOOGLE && !__HAS_IN_REPLY_TO && !__RCD_RDNS_SMTP && !__HAS_THREAD_INDEX && !__RCD_RDNS_MX_MESSY && !__CTYPE_MULTIPART_MIXED && !__RCD_RDNS_MTA && !__VIA_ML && !__HAS_ERRORS_TO
meta AC_FROM_MANY_DOTS __AC_FROM_MANY_DOTS_MINFP
@@ -2728,6 +2728,15 @@ score AC_FROM_MANY_DOTS 3
describe AC_FROM_MANY_DOTS Multiple periods in From user name
tflags AC_FROM_MANY_DOTS publish
+rawbody __AC_LARGE_INDENT /text-indent\s*:\s*[-]?[0-9]{3,}(?:em|p[tx]|%)?(?:\s*!important)?\s*[";]/i
+
+uri __AC_POSTHTMLEXTRAS /(?:main[0-9]?|mian|start(?:page)?|info(?:page|source|center)?|(?:one|view)?(?:site|source)(?:view|[0-9])?|(?:hub|file)one|index(?:[0-9]|page)?|mediafile|userlink|faction1)[.,]html?\/\w{2,}\b/i
+
+uri __AC_POSTIMGEXTRAS /(?:(?:main|external|hosted|new|file)?(?:im(?:g|age)?|user|one)s?-?(?:view(?:er)?|file|map|finder|portal|hub|online)?s?|library|media(?:source|-?files?)?|main|png|view|begin|file|port|space|webpics|host)(?:[-]?(?:[0-9]|one|two|three|four|five|six|seven|eight|nine))?[.,](?:jpe?g|png|gif)\/\w{2,}\b/i
+
+rawbody __AC_TINY_FONT /(?:font-size)\s*:\s*[1-3]\s*(?:em|p[tx]|%)?(?:\s*!important)?\s*[";]/i
+
+
uri __URI_BUFFLY m,//buff\.ly/,i
meta URI_BUFFLY __URI_BUFFLY && !__DOS_HAS_LIST_UNSUB