You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by sm...@apache.org on 2014/10/26 13:02:00 UTC
svn commit: r1634309 - /spamassassin/trunk/rulesrc/sandbox/smf/20_smf.cf
Author: smf
Date: Sun Oct 26 12:02:00 2014
New Revision: 1634309
URL: http://svn.apache.org/r1634309
Log:
Sandbox updates
Modified:
spamassassin/trunk/rulesrc/sandbox/smf/20_smf.cf
Modified: spamassassin/trunk/rulesrc/sandbox/smf/20_smf.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/smf/20_smf.cf?rev=1634309&r1=1634308&r2=1634309&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/smf/20_smf.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/smf/20_smf.cf Sun Oct 26 12:02:00 2014
@@ -67,13 +67,77 @@ endif
# Theory: most glue adds their own Received headers be SpamAssassin
# sees the message, so NO_RECEIVED will never fire when run in that
# way. So lets see if a single Untrusted/External is an indicator.
+header __FSL_COUNT_TRUST X-Spam-Relays-Trusted =~ /\[[^\]]+\]/
+tflags __FSL_COUNT_TRUST multiple
+meta FSL_RCVD_TR_1 (__FSL_COUNT_TRUST == 1)
+score FSL_RCVD_TR_1 0.01
+meta FSL_RCVD_TR_2 (__FSL_COUNT_TRUST == 2)
+score FSL_RCVD_TR_2 0.01
+meta FSL_RCVD_TR_3 (__FSL_COUNT_TRUST == 3)
+score FSL_RCVD_TR_3 0.01
+meta FSL_RCVD_TR_4 (__FSL_COUNT_TRUST == 4)
+score FSL_RCVD_TR_4 0.01
+meta FSL_RCVD_TR_5 (__FSL_COUNT_TRUST == 5)
+score FSL_RCVD_TR_5 0.01
+meta FSL_RCVD_TR_GT_5 (__FSL_COUNT_TRUST > 5)
+
header __FSL_COUNT_UNTRUST X-Spam-Relays-Untrusted =~ /\[[^\]]+\]/
tflags __FSL_COUNT_UNTRUST multiple
+meta FSL_RCVD_UT_1 (__FSL_COUNT_UNTRUST == 1)
+score FSL_RCVD_UT_1 0.01
+meta FSL_RCVD_UT_2 (__FSL_COUNT_UNTRUST == 2)
+score FSL_RCVD_UT_2 0.01
+meta FSL_RCVD_UT_3 (__FSL_COUNT_UNTRUST == 3)
+score FSL_RCVD_UT_3 0.01
+meta FSL_RCVD_UT_4 (__FSL_COUNT_UNTRUST == 4)
+score FSL_RCVD_UT_4 0.01
+meta FSL_RCVD_UT_5 (__FSL_COUNT_UNTRUST == 5)
+score FSL_RCVD_UT_5 0.01
+meta FSL_RCVD_UT_GT_5 (__FSL_COUNT_UNTRUST > 5)
+score FSL_RCVD_UT_GT_5 0.01
+
header __FSL_COUNT_EXTERN X-Spam-Relays-External =~ /\[[^\]]+\]/
tflags __FSL_COUNT_EXTERN multiple
-meta FSL_SINGLE_UNTRUST (__FSL_COUNT_UNTRUST == 1)
-describe FSL_SINGLE_UNTRUST Only a single untrusted received header
-score FSL_SINGLE_UNTRUST 0.01
-meta FSL_SINGLE_EXTERN (__FSL_COUNT_EXTERN == 1)
-describe FSL_SINGLE_EXTERN Only a single external received header
-score FSL_SINGLE_EXTERN 0.01
+meta FSL_RCVD_EX_1 (__FSL_COUNT_EXTERN == 1)
+score FSL_RCVD_EX_1 0.01
+meta FSL_RCVD_EX_2 (__FSL_COUNT_EXTERN == 2)
+score FSL_RCVD_EX_2 0.01
+meta FSL_RCVD_EX_3 (__FSL_COUNT_EXTERN == 3)
+score FSL_RCVD_EX_3 0.01
+meta FSL_RCVD_EX_4 (__FSL_COUNT_EXTERN == 4)
+score FSL_RCVD_EX_4 0.01
+meta FSL_RCVD_EX_5 (__FSL_COUNT_EXTERN == 5)
+score FSL_RCVD_EX_5 0.01
+meta FSL_RCVD_EX_GT_5 (__FSL_COUNT_EXTERN > 5)
+
+rawbody __FSL_HTML_BLOCKS /<((?:div|span))[^>]+>.{1,10}?<\/\1[^>]*>.{0,20}?<\1/si
+tflags __FSL_HTML_BLOCKS multiple
+
+meta FSL_HTML_BLOCK_LOTS_1 (__FSL_HTML_BLOCKS > __FSL_BODY_TEXT_LINE)
+describe FSL_HTML_BLOCK_LOTS_1 More <div> or <span> blocks than lines
+score FSL_HTML_BLOCK_LOTS_1 0.01
+
+meta FSL_HTML_BLOCK_LOTS_2 (__FSL_HTML_BLOCKS > (__FSL_BODY_TEXT_LINE * 2))
+describe FSL_HTML_BLOCK_LOTS_2 More <div> or <span> blocks than twice the amount of lines
+score FSL_HTML_BLOCK_LOTS_2 0.01
+
+meta FSL_HTML_BLOCK_LOTS_3 (__FSL_HTML_BLOCKS > (__FSL_BODY_TEXT_LINE * 4))
+describe FSL_HTML_BLOCK_LOTS_3 More <div> or <span> blocks than 4x the amount of lines
+score FSL_HTML_BLOCK_LOTS_3 0.01
+
+rawbody __FSL_HTML_ENTITIES /\&(?!(?:nbsp|cent|pound|yen|copy|reg|\#1[678][0-9];|\#x[AB][0-9A-F];))(?:\#(?:x[a-f0-9]+|\d{3,4})|[a-zA-Z]+)\;/si
+tflags __FSL_HTML_ENTITIES multiple
+
+meta FSL_HTML_ENT_LOTS_1 (__FSL_HTML_ENTITIES > (__FSL_BODY_TEXT_LINE * 2))
+describe FSL_HTML_ENT_LOTS_1 Lots of HTML entities x2
+score FSL_HTML_ENT_LOTS_1 0.01
+
+meta FSL_HTML_ENT_LOTS_2 (__FSL_HTML_ENTITIES > (__FSL_BODY_TEXT_LINE * 8))
+describe FSL_HTML_ENT_LOTS_2 Lots of HTML entities x8
+score FSL_HTML_ENT_LOTS_2 0.01
+
+meta FSL_HTML_ENT_LOTS_3 (__FSL_HTML_ENTITIES > (__FSL_BODY_TEXT_LINE * 24))
+describe FSL_HTML_ENT_LOTS_3 Lots of HTML entities x24
+score FSL_HTML_ENT_LOTS_3 0.01
+
+