You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by qu...@apache.org on 2004/04/26 05:39:43 UTC
svn commit: rev 10273 - incubator/spamassassin/trunk/rules
Author: quinlan
Date: Sun Apr 25 20:39:42 2004
New Revision: 10273
Modified:
incubator/spamassassin/trunk/rules/20_porn.cf
incubator/spamassassin/trunk/rules/70_testing.cf
Log:
remove some test rules
replace LOTS_OF_STUFF with T_LOTS_OF_STUFF_13
add T_ENTITY_HEX_ANY
Modified: incubator/spamassassin/trunk/rules/20_porn.cf
==============================================================================
--- incubator/spamassassin/trunk/rules/20_porn.cf (original)
+++ incubator/spamassassin/trunk/rules/20_porn.cf Sun Apr 25 20:39:42 2004
@@ -85,8 +85,8 @@
body PORN_16 /\b(?:nasty|teen|dir(?:ty|iest)?|little).{0,16}\bsluts?/i
describe PORN_16 Possible porn - nasty, dirty, little etc.
-body LOTS_OF_STUFF /\b(?:\d{1,3}[,\.])+\d{3}.{0,20}\b(?:pics|pictures|images|photos|movies)/i
-describe LOTS_OF_STUFF Thousands or millions of pics/movies/etc
+body LOTS_OF_STUFF /\b(?:\d{1,3}[,\.]?)+\d{3}.{0,20}\b(?:pics|pictures|images|photos|movies)/i
+describe LOTS_OF_STUFF Thousands or millions of pictures, movies, etc.
body DISGUISE_PORN /\b(?:c[*0]cks?|d[1*]cks?|h[0*]rny|b[1*]tch(?:es)|f[*0]ckk?ed|p[*]ssy|p[*]ssies)\b/i
describe DISGUISE_PORN Attempts to disguise porn words
Modified: incubator/spamassassin/trunk/rules/70_testing.cf
==============================================================================
--- incubator/spamassassin/trunk/rules/70_testing.cf (original)
+++ incubator/spamassassin/trunk/rules/70_testing.cf Sun Apr 25 20:39:42 2004
@@ -43,6 +43,8 @@
rawbody T_ENTITY_HEX_OTHER_1 /\&\#x(?:2[1457892cdef]|3[abdf]|40|5f)\;/i
rawbody T_ENTITY_HEX_OTHER_2 /\&\#x0*(?:2[1457892cdef]|3[abdf]|40|5f)\;/i
+rawbody T_ENTITY_HEX_ANY /\&\#x[\da-f]+\;/i
+
########################################################################
# similar concept for Delphi.com. Was an ISP, now a car company!
@@ -56,24 +58,6 @@
header __YAHOO_BEGINNING Message-ID =~ /<\S+(?:\.\S+|\.\S+\.\S+\.\S+)\@/
meta T_FORGED_YAHOO_MSGID (__YAHOO_MSGID && !__YAHOO_BEGINNING)
-# reported by Kurtis Rader, bug 2890
-# problem: miniscule hits
-uri T_MSN_REDIR m{^https?://shopping\.msn\.com/trackurl\.aspx\?}i
-describe T_MSN_REDIR Has MSN Redirect URI
-
-# reported by Kurtis Rader, bug 2901
-# miniscule hits
-uri T_AOL_REDIR m{^https?://www\.aol\.com/(?:ams/|.*https?://)}i
-#describe T_AOL_REDIR Has AOL Redirect URI
-
-# bug 2950
-# both look promotable
-# really? low hit rates...
-# suggestion: we combine MSN, AOL and Google redir rules. All are
-# 1.0 S/Os but low hitrates
-uri T_GOOGLE_IMAGES m{^http://images\.google(\.\S+)?\.[a-z]{2,3}/imgres\?}i
-uri T_GOOGLE_REDIR m{^http://www\.google(\.\S+)?\.[a-z]{2,3}/url\?}i
-
# more portable replacement for RCVD_NUMERIC_HELO that doesn't rely on
# Received headers using "helo=" prefix. exclude squirrelmail, which
# records a perfectly-ok rcvd header for the HTTP step in this fmt
@@ -81,14 +65,6 @@
header __SQUIRREL_AUTH Received =~ /SquirrelMail authenticated user/
meta T_RCVD_NUMERIC_HELO (__RCVD_NUMERIC_HELO && !__SQUIRREL_AUTH)
describe T_RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
-# same but not for first line
-header __RCVD_NUMERIC_HELO_NOTFIRST X-Spam-Relays-Untrusted =~ / helo=\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} .+\[/
-meta T_RCVD_NUMERIC_HELO_NOTFIRST (__RCVD_NUMERIC_HELO_NOTFIRST && !__SQUIRREL_AUTH)
-describe T_RCVD_NUMERIC_HELO_NOTFIRST Received: contains IP for HELO (not first line)
-# same but for the last untrusted host
-header __RCVD_NUMERIC_HELO_LASTUNT X-Spam-Relays-Untrusted =~ /^[^\]]* helo=\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} /
-meta T_RCVD_NUMERIC_HELO_LASTUNT (__RCVD_NUMERIC_HELO_NOTFIRST && !__SQUIRREL_AUTH)
-describe T_RCVD_NUMERIC_HELO_LASTUNT Received: contains IP for HELO (not first line)
# 0.683 1.3791 0.0134 0.990 0.90 0.01 T_URI_UNPRINTABLE:quinlan
# 0.956 1.1479 0.5948 0.659 0.26 0.01 T_URI_UNPRINTABLE:rODbegbie
@@ -299,25 +275,6 @@
meta T_SARE_RAND_1G (__RANDH_1G || __RANDR_1G)
meta T_SARE_RAND_1H (__RANDH_1H || __RANDR_1H)
meta T_SARE_RAND_1I (__RANDH_1I || __RANDR_1I)
-
-
-# meant to target porn (thousands of somethings), but was hitting URIs too
-# before URI were no longer stuffed into "body" rendering
-uri T_LOTS_OF_STUFF_01 /\b(?:\d{1,3}[,\.])+\d{3}.{0,20}\b(?:pics|pictures|images|photos|movies)/i
-uri T_LOTS_OF_STUFF_02 /\b(?:\d{1,3}[,\.])+\d{3}.{0,20}\b(?:pics|pictures|images|photos|movies|imgs?)/i
-uri T_LOTS_OF_STUFF_03 /\b(?:\d{1,3}[,\.])+\d{3}.{0,20}\b(?:pics?|pictures?|images?|photos?|movies?|imgs?)/i
-rawbody T_LOTS_OF_STUFF_04 /\b(?:\d{1,3}[,\.])+\d{3}.{0,20}\b(?:pics|pictures|images|photos|movies)/i
-rawbody T_LOTS_OF_STUFF_05 /\b(?:\d{1,3}[,\.])+\d{3}.{0,20}\b(?:pics|pictures|images|photos|movies|imgs?)/i
-rawbody T_LOTS_OF_STUFF_06 /\b(?:\d{1,3}[,\.])+\d{3}.{0,20}\b(?:pics?|pictures?|images?|photos?|movies?|imgs?)/i
-body T_LOTS_OF_STUFF_07 /\b(?:\d{1,3}[,\.])+\d{3}.{0,20}\b(?:pics|pictures|images|photos|movies)/i
-body T_LOTS_OF_STUFF_08 /\b(?:\d{1,3}[,\.])+\d{3}.{0,20}\b(?:pics|pictures|images|photos|movies|imgs?)/i
-body T_LOTS_OF_STUFF_09 /\b(?:\d{1,3}[,\.])+\d{3}.{0,20}\b(?:pics?|pictures?|images?|photos?|movies?|imgs?)/i
-body T_LOTS_OF_STUFF_10 /\b(?:\d{1,3},?)+\d{3}.{0,20}\b(?:pics|pictures|images|photos|movies)/i
-body T_LOTS_OF_STUFF_11 /\b(?:\d{1,3},?)+\d{3}.{0,20}\b(?:pics|pictures|images|photos|movies|imgs?)/i
-body T_LOTS_OF_STUFF_12 /\b(?:\d{1,3},?)+\d{3}.{0,20}\b(?:pics?|pictures?|images?|photos?|movies?|imgs?)/i
-body T_LOTS_OF_STUFF_13 /\b(?:\d{1,3}[,\.]?)+\d{3}.{0,20}\b(?:pics|pictures|images|photos|movies)/i
-body T_LOTS_OF_STUFF_14 /\b(?:\d{1,3}[,\.]?)+\d{3}.{0,20}\b(?:pics|pictures|images|photos|movies|imgs?)/i
-body T_LOTS_OF_STUFF_15 /\b(?:\d{1,3}[,\.]?)+\d{3}.{0,20}\b(?:pics?|pictures?|images?|photos?|movies?|imgs?)/i
# Matt Kettler's antidrug.cf ruleset. bug 3009
# should probably move good ones from here directly into 20_drugs.cf?