You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2024/11/06 15:44:55 UTC
svn commit: r1921798 - /spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Wed Nov 6 15:44:55 2024
New Revision: 1921798
URL: http://svn.apache.org/viewvc?rev=1921798&view=rev
Log:
Bug 8288 exploit rule appears to perform well; FP tune, score and publish.
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1921798&r1=1921797&r2=1921798&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Wed Nov 6 15:44:55 2024
@@ -4291,7 +4291,12 @@ describe URI_NOCODEFORM U
tflags URI_NOCODEFORM publish
+# Look for exploits of Bug 8288 - seems fairly common
rawbody __URI_EXCESS_SLASHES m;https?:///+;i
+meta URI_EXCESS_SLASHES __URI_EXCESS_SLASHES && !__RCD_RDNS_MAIL_MESSY
+score URI_EXCESS_SLASHES 2.500
+describe URI_EXCESS_SLASHES Too many slashes in URI, possible attempt to bypass spam filtering
+tflags URI_EXCESS_SLASHES publish