Re[2]: Does SA 304 look for these HTML tricks?

[Robert Menschel <Ro...@Menschel.net>]

Hello Matt, Dr. Young,

Friday, July 15, 2005, 10:40:03 AM, you wrote:

MK> Dr Robert Young wrote:
>> <font size=0>.....</font>
>> <font size=1>{whatever}</font>

MK> Those should both trip  HTML_FONT_SIZE_TINY.
MK> Unfortunately, that's a low scoring rule due to some FPs and limited number of
MK> spam hits in the 3.0 corpus. The FPs may or may not be corpus pollution based.
MK> *shrug*

They also hit slightly different rules (also with low scores, beacuse
of ham hits), in 70_sare_html3.cf

>> inserting "<!---text--->" in the middle of "key words"

MK> HTML tags are completely stripped before normal "body" rules are run, so this
MK> trick, or any other trick based on inserting tags, has no effect on SA at all.
MK> Only rawbody or full rules could be affected.

Except that SA does include some rawbody rules.  And here too, SARE
html rules will flag the match.

MK> The striping doesn't work with the font-size trick, as SA's body rules will see
MK> "VIwhateverAGRA"  for "VA<font size=0>whatever</font>AGRA".

Bob Menschel