You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2012/04/10 17:09:15 UTC
[Bug 6788] New: URL detection sometimes does not work
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6788
Bug #: 6788
Summary: URL detection sometimes does not work
Product: Spamassassin
Version: 3.3.1
Platform: PC
OS/Version: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Rules
AssignedTo: dev@spamassassin.apache.org
ReportedBy: lemat@lemat.priv.pl
Classification: Unclassified
Below are two examples of spam (I have removed what I believe was not
important), in the first example the parser cannot find the URL
toppolandjob.com while in the second example this URL/domain is found and
triggers URIBL tests.
As you see there are different Content-Transfer-Encoding for these emails and
the line in first example is longer than 75 chars.
Content-Type: text/html;
charset=windows-1250
Content-Transfer-Encoding: 7bit
Wniosek należy wysłać na nasz adres e-mail:<b>
Earline@toppolandjob.com</b>Odpowiedź otrzymasz w ciągu dwóch
dni roboczych.<br>
Content-Type: text/html
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Prześlij wniosek na mój e-mail <b> Maddox@toppolandjob.com</b> =
i ja osobiście odpowiem Ci w ciągu 2 dni roboczych.<br>
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6788] URL detection sometimes does not work
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6788
Kevin A. McGrail <km...@pccc.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|WORKSFORME |---
--- Comment #6 from Kevin A. McGrail <km...@pccc.com> ---
(In reply to comment #5)
> this is not a duplicate of bug 6751. The dot is always 2E hex.
Sorry about that. I viewed that as an alternate character being used and lumped
it together.
Reopening though I tried your small fix in HTML.pm
Index: lib/Mail/SpamAssassin/HTML.pm
===================================================================
--- lib/Mail/SpamAssassin/HTML.pm (revision 1338322)
+++ lib/Mail/SpamAssassin/HTML.pm (working copy)
@@ -240,6 +240,10 @@
# the HTML::Parser API won't do it for us
$text =~ s/<(\w+)\s*\/>/<$1>/gi;
+ # Bug 6788 https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6788
+ # we want a space after a closing tag so that URLs aren't lumped together
+ $text =~ s/>/> /g;
+
# Ignore stupid warning that can't be suppressed: 'Parsing of
# undecoded UTF-8 will give garbage when decoding entities at ..' (bug 4046)
{
This breaks html_obfu.t
t/html_obfu.t 9 5 55.56% 1-5
Thoughts?
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 6788] URL detection sometimes does not work
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6788
Lemat <le...@lemat.priv.pl> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|DUPLICATE |WORKSFORME
--- Comment #5 from Lemat <le...@lemat.priv.pl> ---
this is not a duplicate of bug 6751. The dot is always 2E hex.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 6788] URL detection sometimes does not work
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6788
D. Stussy <so...@kd6lvw.ampr.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |software+spamassassin@kd6lv
| |w.ampr.org
--- Comment #2 from D. Stussy <so...@kd6lvw.ampr.org> 2012-04-11 21:48:32 UTC ---
No. The dot in URL is 2E using hex. Hexidecimal always uses CAPITAL letters.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6788] URL detection sometimes does not work
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6788
--- Comment #7 from Lemat <le...@lemat.priv.pl> ---
today my fix failed. I just had spam without HTML:
Nasz e-mail: Ambrozy@fastpolandjob.com,Szczerze wasz
as you see there is a comma between URI and text - without spaces. I wonder
what else can be used to obsfucate...
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 6788] URL detection sometimes does not work
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6788
--- Comment #3 from Lemat <le...@lemat.priv.pl> 2012-04-23 22:45:41 UTC ---
those headers were misleading...
the problem is with space at the end of URL
the parser is (probably) removing HTML tags and dots, commas etc. making
something like that:
toppolandjob.com</b>Odp... -> toppolandjob.comOdp...- URI not found
toppolandjob.com,</b>Odp... -> toppolandjob.comOdp... - URI not found
toppolandjob.com</b> Odp... -> toppolandjob.com Odp... - URI found
toppolandjob.com,</b> Odp... -> toppolandjob.com Odp... - URI found
toppolandjob.com </b>Odp... -> toppolandjob.com Odp... - URI found
fix:
HTML.pm
sub parse {
...
$text =~ s/>/> /g; # before $self->SUPER::parse(...
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6788] URL detection sometimes does not work
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6788
Lemat <le...@lemat.priv.pl> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |lemat@lemat.priv.pl
--- Comment #1 from Lemat <le...@lemat.priv.pl> 2012-04-10 21:46:38 UTC ---
The dot in URL is 2e hex.
--
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
[Bug 6788] URL detection sometimes does not work
Posted by bu...@bugzilla.spamassassin.org.
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6788
Kevin A. McGrail <km...@pccc.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
CC| |kmcgrail@pccc.com
Resolution|--- |DUPLICATE
--- Comment #4 from Kevin A. McGrail <km...@pccc.com> ---
I believe this is a duplicate of a bug already in the system.
*** This bug has been marked as a duplicate of bug 6751 ***
--
You are receiving this mail because:
You are the assignee for the bug.