svn commit: r1245851 - /spamassassin/trunk/rulesrc/sandbox/khopesh/20_neon_overload.cf

[kh...@apache.org]

Author: khopesh
Date: Sat Feb 18 02:54:33 2012
New Revision: 1245851

URL: http://svn.apache.org/viewvc?rev=1245851&view=rev
Log:
neon_overload JS rules: updates from the author (and me)

Modified:
    spamassassin/trunk/rulesrc/sandbox/khopesh/20_neon_overload.cf

Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_neon_overload.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_neon_overload.cf?rev=1245851&r1=1245850&r2=1245851&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_neon_overload.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_neon_overload.cf Sat Feb 18 02:54:33 2012
@@ -5,20 +5,31 @@
 # WTFPL 2.0 basically says "rename things and they're essentially public domain"
 # Rules have been renamed and slightly tweaked
 
-rawbody  JS_EXTRA_UNESCAPE	/[+=]\s{0,9}unescape\s{0,9}\(\s{0,9}["']%(?i:6[1-9A-F]|7[0-9A])/
-describe JS_EXTRA_UNESCAPE	JavaScript: Unnecessary URI escaping
-#score LOCAL_UNNECESSARY_UNESCAPE 1.7
-
-rawbody  JS_EXTRA_CONCAT	/[+=]\s{0,9}["'][a-z0-9]{1,64}["']\+["'][a-z0-9]{1,64}["']/i
-describe JS_EXTRA_CONCAT	JavaScript: Unnecessary string concatination
-#score LOCAL_UNNECESSARY_STRCONCAT 0.5
-
-rawbody  JS_FROMCHARCODE	/=\s{0,9}String\.fromCharCode\b/
-describe JS_FROMCHARCODE	JavaScript: function String.fromCharCode
-#score LOCAL_HIDE_FROMCHARCODE 0.7
-
-#rawbody  LOCAL_HIDE_URL	/"h"\+"tt"\+"p:"\+"\/"/
-rawbody  JS_CONCATINATED_HTTP	m@(?!http:/)h["'+]{0,3}(?:t["'+]{0,3}){2}p['"+]{0,3}:['"+]{0,3}/@
-describe JS_CONCATINATED_HTTP	Contains concatenated URI like "htt"+"p://..."
-#score LOCAL_HIDE_URL 0.7
+rawbody  T_AK_JS_EXTRA_UNESCAPE /[+=(]\s{0,9}unescape\s{0,9}\(\s{0,9}["']%(?i:6[1-9A-F]|7[0-9A])/
+describe T_AK_JS_EXTRA_UNESCAPE JavaScript: Unnecessary URI escaping
+#score LOCAL_U_UNESCAPE 1.8
+
+rawbody  T_AK_JS_EXTRA_CONCAT	/[+=(]\s{0,9}["'][a-z0-9.]{1,32}["'] ?\+ ?["'][a-z0-9]{1,32}["']/i
+describe T_AK_JS_EXTRA_CONCAT	JavaScript: Unnecessary string concatination
+#score LOCAL_U_STRCONCAT 0.7
+
+rawbody  T_AK_JS_FROMCHARCODE	/[+=(]\s{0,9}String\.fromCharCode\b/
+describe T_AK_JS_FROMCHARCODE	JavaScript: function String.fromCharCode
+#score LOCAL_HIDE_FROMCHARCODE 0.6
+
+#rawbody LOCAL_HIDE_URL /[+=(]\s*(["'])(?!http)h(\1 ?\+ ?\1)?t(\1 ?\+ ?\1)?t(\1 ?\+ ?\1)?p(\1 ?\+ ?\1)?(?!:\/\/):(\1 ?\+ ?\1)?\/(\1 ?\+ ?\1)?\//
+rawbody  T_AK_JS_CONCATINATED_HTTP m@\b(?!http:/)h["'+]{0,3}(?:t["'+]{0,3}){2}p['"+]{0,3}:['"+]{0,3}/@
+describe T_AK_JS_CONCATINATED_HTTP Contains concatenated URI like "htt"+"p://..."
+#score LOCAL_HIDE_URL 0.9
+
+#rawbody LOCAL_JS_REDIR1 /<[Ss][Cc][Rr][Ii][Pp][Tt]\s*(type="[^"]+"\s*)?>\s*(window|self|(var\s+)?([a-z]+)\s*=\s*window\s*;?\s*\4)?\.?(location|\[['"]location['"]\])(\.href)?\s*[=(]/
+rawbody T_AK_JS_REDIRECTION_1	/<script\s(?-i)[^>]{0,75}>(?:\s{0,9}.{0,1024};)?\s{0,9}\b(?:window|self|([a-z]+)\s{0,9}=\s{0,9}(?:window|self)\s{0,9};?\s{0,9}\1)?\.?(?:location|\[['"]location['"]\])(?:\.href)?\s{0,9}[=(]/msi
+rawbody T_AK_JS_REDIRECTION_2	/<script\s(?-i).{1,1024}(?:[.\s]|\[["'])location\b(?:["']\])?\s{0,9}(?:\.href)?\s{0,9}[=(]/msi
+describe T_AK_JS_REDIRECTION_1	Script: Current window's location is redirected
+describe T_AK_JS_REDIRECTION_2	Script: Something changes location (a redirection)
+#score LOCAL_JS_REDIR1 0.5
+
+body T_AK_FILLER_TEXT		/\b(?:[A-Z][a-z]{0,16}\b(?:\s[a-z]{1,16}\b){4,6}\.?\s{0,2}){18}/
+describe T_AK_FILLER_TEXT	18 sentences of capitalized word, 4-6 words, period
+#score LOCAL_FILLER_TEXT 0.4