You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by km...@apache.org on 2011/10/17 22:28:21 UTC
svn commit: r1185356 -
/spamassassin/trunk/rulesrc/sandbox/kmcgrail/20_darxus_experimental.cf
Author: kmcgrail
Date: Mon Oct 17 20:28:21 2011
New Revision: 1185356
URL: http://svn.apache.org/viewvc?rev=1185356&view=rev
Log:
Added Spoofed URL test rule per bug 6676 for Darxus
Added:
spamassassin/trunk/rulesrc/sandbox/kmcgrail/20_darxus_experimental.cf
Added: spamassassin/trunk/rulesrc/sandbox/kmcgrail/20_darxus_experimental.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/kmcgrail/20_darxus_experimental.cf?rev=1185356&view=auto
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/kmcgrail/20_darxus_experimental.cf (added)
+++ spamassassin/trunk/rulesrc/sandbox/kmcgrail/20_darxus_experimental.cf Mon Oct 17 20:28:21 2011
@@ -0,0 +1,5 @@
+#Based on khopesh's SPOOFED_URL.
+rawbody __SPOOFED_URL_HOST /<a\s[^>]{0,2048}\bhref=(?:3D)?.?(https?:\/\/?[^\/?>"'\# ]{8,29})[^>]{0,2048}>(?:[^<]{0,1024}<(?!\/a)[^>]{1,1024}>){0,99}\s{0,10}(?!\1)https?[^\w<]{1,3}[^<]{5}/i
+# Still doesn't handle 'legit' tracking redirectors.
+meta SPOOFED_URL_HOST __SPOOFED_URL_HOST && !(__VIA_ML || __SENDER_BOT || __YAHOO_BULK || __UNSUB_LINK || __THREADED || URL_SHORTENER)
+describe SPOOFED_URL_HOST Has a link whose text is URL with a different host