You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jm...@apache.org on 2004/03/18 05:48:09 UTC
svn commit: rev 9580 - incubator/spamassassin/trunk/rules
Author: jm
Date: Wed Mar 17 20:48:08 2004
New Revision: 9580
Modified:
incubator/spamassassin/trunk/rules/20_fake_helo_tests.cf
incubator/spamassassin/trunk/rules/70_testing.cf
Log:
oops, typo and too-long desc
Modified: incubator/spamassassin/trunk/rules/20_fake_helo_tests.cf
==============================================================================
--- incubator/spamassassin/trunk/rules/20_fake_helo_tests.cf (original)
+++ incubator/spamassassin/trunk/rules/20_fake_helo_tests.cf Wed Mar 17 20:48:08 2004
@@ -136,7 +136,7 @@
# wiley-170-10231.roadrunner.nf.net [205.251.210.249]
header HELO_DYNAMIC_RR2 X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]+-\d{1,3}-\d{1,5}\.roadrunner/i
-describe HELO_DYNAMIC_RR2 Relay HELO'd using suspicious hostname (Roadrunner 2)
+describe HELO_DYNAMIC_RR2 Relay HELO'd using suspicious hostname (RR 2)
# pcp04024417pcs.toresd01.pa.comcast.net [68.86.206.126]
# bgp542174bgs.ewndsr01.nj.comcast.net[68.38.144.91]
Modified: incubator/spamassassin/trunk/rules/70_testing.cf
==============================================================================
--- incubator/spamassassin/trunk/rules/70_testing.cf (original)
+++ incubator/spamassassin/trunk/rules/70_testing.cf Wed Mar 17 20:48:08 2004
@@ -109,6 +109,7 @@
describe T_MSN_REDIR Has MSN Redirect URI
# reported by Kurtis Rader, bug 2901
+# miniscule hits
uri T_AOL_REDIR_1 m{^https?://www\.aol\.com/ams/clickThruRedirect.adp\?}i
uri T_AOL_REDIR_2 m{^https?://www\.aol\.com/ams/}i
uri T_AOL_REDIR_3 m{^https?://www\.aol\.com/.*https?://}i
@@ -227,6 +228,7 @@
body T_URGENT_BIZ /urgent.{0,16}(?:assistance|business|buy|confidential|notice|proposal|reply|request|response)/i
# bug 2950
+# both look promotable
uri T_GOOGLE_IMAGES m{^http://images\.google(\.\S+)?\.[a-z]{2,3}/imgres\?}i
uri T_GOOGLE_REDIR m{^http://www\.google(\.\S+)?\.[a-z]{2,3}/url\?}i
@@ -361,13 +363,6 @@
body T_HTML_TEXT_CONTRAST_24 eval:html_test('text_contrast_24')
body T_HTML_TEXT_CONTRAST_32 eval:html_test('text_contrast_32')
-# bug 2164
-# You must be joking, can you say "unix pipes" and "regular expressions"?
-# 10.263 14.0650 1.1050 0.927 0.77 0.01 T_PIPE_OBFU
-# ;)
-body T_PIPE_OBFU /[a-z]\|[a-z]/i
-describe T_PIPE_OBFU Words dis|guised with a pipe sym|bol
-
# Should catch Atriks, for one
uri T_LONG_HOSTNAME_25 /^https?:\/\/[a-z0-9]{25,29}\./i
uri T_LONG_HOSTNAME_30 /^https?:\/\/[a-z0-9]{30,40}\./i
@@ -535,7 +530,7 @@
# spams that are assembled from a Javascript array
# look for the XOR op
-rawbody __JS_FROMCHARCODE /String\.fromCharCode\s*(\s*\S+\s*\[\s*\S+\s*\]\s*\^/
+rawbody __JS_FROMCHARCODE /String\.fromCharCode\s*\(\s*\S+\s*\[\s*\S+\s*\]\s*\^/
rawbody __JS_DOCWRITE /document\.write/
meta T_JS_FROMCHARCODE (__JS_FROMCHARCODE && __JS_DOCWRITE)