You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by pd...@apache.org on 2019/05/15 17:12:31 UTC
svn commit: r1859303 - in /spamassassin/trunk/rulesrc/sandbox/pds:
20_pdsmetas.cf 20_php.cf
Author: pds
Date: Wed May 15 17:12:31 2019
New Revision: 1859303
URL: http://svn.apache.org/viewvc?rev=1859303&view=rev
Log:
Split out metas
Added:
spamassassin/trunk/rulesrc/sandbox/pds/20_php.cf
- copied, changed from r1859302, spamassassin/trunk/rulesrc/sandbox/pds/20_pdsmetas.cf
Removed:
spamassassin/trunk/rulesrc/sandbox/pds/20_pdsmetas.cf
Copied: spamassassin/trunk/rulesrc/sandbox/pds/20_php.cf (from r1859302, spamassassin/trunk/rulesrc/sandbox/pds/20_pdsmetas.cf)
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/pds/20_php.cf?p2=spamassassin/trunk/rulesrc/sandbox/pds/20_php.cf&p1=spamassassin/trunk/rulesrc/sandbox/pds/20_pdsmetas.cf&r1=1859302&r2=1859303&rev=1859303&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/pds/20_pdsmetas.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/pds/20_php.cf Wed May 15 17:12:31 2019
@@ -1,11 +1,16 @@
header __PDS_PHP_EVAL1 X-PHP-Originating-Script =~ /eval..'d code/i
header __PDS_PHP_EVAL2 X-PHP-Originating-Script =~ /runtime-created function/
-meta PDS_PHP_EVAL (__PDS_PHP_EVAL1 || __PDS_PHP_EVAL2)
+meta PDS_PHP_EVAL __PDS_PHP_EVAL1
describe PDS_PHP_EVAL PHP header shows eval'd code
score PDS_PHP_EVAL 1.5
reuse PDS_PHP_EVAL
+meta PDS_PHP_RUNTIME_FUNC __PDS_PHP_EVAL2 && !__PDS_PHP_EVAL1
+describe PDS_PHP_RUNTIME_FUNC PHP header shows runtime-created function
+score PDS_PHP_RUNTIME_FUNC 1.5
+reuse PDS_PHP_RUNTIME_FUNC
+
header __PDS_X_PHP_WPCONTENT X-PHP-Script =~ /\/wp-content\/(themes|uploads)\/[\S]+\.php for/i
header __PDS_X_PHP_WPINCLUDES X-PHP-Script =~ /\/wp-includes\/(js|css)\/[\S]+\.php for/i
header __PDS_X_PHP_WPADMIN X-PHP-Script =~ /\/wp-admin\/(css|themes|js)\/[\S]+\.php for/i