[Bug 6171] New: Drugs rules don't detect runtogether words

[bu...@bugzilla.spamassassin.org]

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6171

           Summary: Drugs rules don't detect runtogether words
           Product: Spamassassin
           Version: SVN Trunk (Latest Devel Version)
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: minor
          Priority: P4
         Component: Rules
        AssignedTo: dev@spamassassin.apache.org
        ReportedBy: cedric@gn.apc.org


Created an attachment (id=4502)
 --> (https://issues.apache.org/SpamAssassin/attachment.cgi?id=4502)
Anonymised sample from 090730 showing full body not hitting drug rules

Rules in 20_drugs.cf try to detect straightforward names of particular drugs
bounded with \b ; and also obfuscated names of drugs bounded with \b.  An
obfuscation seen recently is "CialisSuper" and "ViagraAs low as $1.85", which
doesn't hit either rule because there is no \b boundary, and scores nothing on
content.  Care is particularly needed with 'cialis', which occurs within words
such as 'specialism'.

-- 
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

[Bug 6171] Drugs rules don't detect runtogether words

[bu...@bugzilla.spamassassin.org]

https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6171





--- Comment #1 from Cedric Knight <ce...@gn.apc.org>  2009-08-04 19:12:22 PST ---
Created an attachment (id=4503)
 --> (https://issues.apache.org/SpamAssassin/attachment.cgi?id=4503)
Provisional patch to detect runtogether erectile drug names; fix rule
description

The patch detects changes of case after 'levitra' and 'cialis', so 'Ci@lisAs',
for example, scores as an obfuscated drug name.  For 'viagra', a different
approach is used, so that 'viagralike', for example, even though in consistent
case, scores as obfuscated.  It also simplifies the definition of a word
boundary as (\b|_).  This patch is more of an example, and maybe similar
changes should happen to other drug word endings; a similar check could happen
at the first boundary to stop, e.g. 'BuyCIALIS!'.

This patch also provides a more accurate description of the SUBJECT_FUZZY_MEDS
which the sample *did* hit, although the word in the title was actually not
obfuscated.

-- 
Configure bugmail: https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.