You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by fk...@apache.org on 2025/01/14 01:20:39 UTC
svn commit: r1923114 - in /spamassassin/trunk: lib/Mail/SpamAssassin/Plugin/Phishing.pm t/data/spam/phishing_openphish.eml
Author: fkento
Date: Tue Jan 14 01:20:38 2025
New Revision: 1923114
URL: http://svn.apache.org/viewvc?rev=1923114&view=rev
Log:
Fix bug with phishing_uri_noparam
Modified:
spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/Phishing.pm
spamassassin/trunk/t/data/spam/phishing_openphish.eml
Modified: spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/Phishing.pm
URL: http://svn.apache.org/viewvc/spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/Phishing.pm?rev=1923114&r1=1923113&r2=1923114&view=diff
==============================================================================
--- spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/Phishing.pm (original)
+++ spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/Phishing.pm Tue Jan 14 01:20:38 2025
@@ -218,6 +218,7 @@ sub _read_configfile {
my $conf = $self->{main}->{registryboundaries}->{conf};
my (@phtank_ln, @phstats_ln);
my $stripped_cluri;
+ my $phishing_uri_noparam = $self->{main}->{conf}->{phishing_uri_noparam};
local *F;
if ( defined($conf->{phishing_openphish_feed}) && ( -f $conf->{phishing_openphish_feed} ) ) {
@@ -227,6 +228,12 @@ sub _read_configfile {
#lines that start with pound are comments
next if(/^\s*\#/);
$stripped_cluri = $_;
+ if( $phishing_uri_noparam eq 1 && $stripped_cluri =~ s/\?.*// ) {
+ # If uri without parameters are considered, skip too short uris
+ # like https://www.google.com/url?sa=t&url=http://badsite.com
+ my $dcnt = $stripped_cluri =~ tr/\///;
+ next if $dcnt <= 3;
+ }
my $phishdomain = $self->{main}->{registryboundaries}->uri_to_domain($_);
if ( defined $phishdomain ) {
push @{$self->{PHISHING}->{$stripped_cluri}->{phishdomain}}, $phishdomain;
@@ -252,6 +259,12 @@ sub _read_configfile {
@phtank_ln = split(/,/, $_);
$phtank_ln[1] =~ s/\"//g;
$stripped_cluri = $phtank_ln[1];
+ if( $phishing_uri_noparam eq 1 && $stripped_cluri =~ s/\?.*// ) {
+ # If uri without parameters are considered, skip too short uris
+ # like https://www.google.com/url?sa=t&url=http://badsite.com
+ my $dcnt = $stripped_cluri =~ tr/\///;
+ next if $dcnt <= 3;
+ }
my $phishdomain = $self->{main}->{registryboundaries}->uri_to_domain($phtank_ln[1]);
if ( defined $phishdomain ) {
push @{$self->{PHISHING}->{$stripped_cluri}->{phishdomain}}, $phishdomain;
@@ -283,6 +296,12 @@ sub _read_configfile {
next;
}
$stripped_cluri = $phstats_ln[2];
+ if( $phishing_uri_noparam eq 1 && $stripped_cluri =~ s/\?.*// ) {
+ # If uri without parameters are considered, skip too short uris
+ # like https://www.google.com/url?sa=t&url=http://badsite.com
+ my $dcnt = $stripped_cluri =~ tr/\///;
+ next if $dcnt <= 3;
+ }
my $phishdomain = $self->{main}->{registryboundaries}->uri_to_domain($phstats_ln[2]);
if ( defined $phishdomain ) {
push @{$self->{PHISHING}->{$stripped_cluri}->{phishdomain}}, $phishdomain;
@@ -303,6 +322,12 @@ sub _read_configfile {
#lines that start with pound are comments
next if(/^\s*\#/);
$stripped_cluri = $_;
+ if( $phishing_uri_noparam && $stripped_cluri =~ s/\?.*// ) {
+ # If uri without parameters are considered, skip too short uris
+ # like https://www.google.com/url?sa=t&url=http://badsite.com
+ my $dcnt = $stripped_cluri =~ tr/\///;
+ next if $dcnt <= 3;
+ }
my $phishdomain = $self->{main}->{registryboundaries}->uri_to_domain($_);
if ( defined $phishdomain ) {
push @{$self->{PHISHING}->{$stripped_cluri}->{phishdomain}}, $phishdomain;
@@ -323,7 +348,7 @@ sub check_phishing {
my $feedname;
my $domain;
my $stripped_cluri;
- my $dcnt;
+ my $phishing_uri_noparam = $self->{main}->{conf}->{phishing_uri_noparam};
my $uris = $pms->get_uri_detail_list();
my $rulename = $pms->get_current_eval_rule_name();
@@ -336,15 +361,7 @@ sub check_phishing {
if (($info->{types}->{a}) || ($info->{types}->{parsed})) {
# check url
$stripped_cluri = $uri;
- if( $self->{main}->{conf}->{phishing_uri_noparam} eq 1 ) {
- $stripped_cluri =~ s/\?.*//;
- $dcnt = $stripped_cluri =~ tr/\///;
- }
- # If uri without parameters are considered, skip too short uris
- # like https://www.google.com/url?sa=t&url=http://badsite.com
- if( ($self->{main}->{conf}->{phishing_uri_noparam} eq 1) && ($dcnt <= 3) && ($uri =~ /\?/) ) {
- next;
- }
+ $stripped_cluri =~ s/\?.*// if $phishing_uri_noparam;
if ( exists $self->{PHISHING}->{$stripped_cluri} ) {
$domain = $self->{main}->{registryboundaries}->uri_to_domain($uri);
$feedname = $self->{PHISHING}->{$stripped_cluri}->{phishinfo}->{$domain}[0];
Modified: spamassassin/trunk/t/data/spam/phishing_openphish.eml
URL: http://svn.apache.org/viewvc/spamassassin/trunk/t/data/spam/phishing_openphish.eml?rev=1923114&r1=1923113&r2=1923114&view=diff
==============================================================================
--- spamassassin/trunk/t/data/spam/phishing_openphish.eml (original)
+++ spamassassin/trunk/t/data/spam/phishing_openphish.eml Tue Jan 14 01:20:38 2025
@@ -8,6 +8,7 @@ To: test@example.com
Subject: Phishing Test OpenPhish
Date: Wed, 18 Jul 2018 12:12:00 -0700 (PDT)
MIME-Version: 1.0
+Content-Type: text/html; charset=UTF-8
Message-Id: <20...@gmail.com>
<html>