You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by qu...@apache.org on 2004/02/04 09:09:36 UTC
svn commit: rev 6493 - in incubator/spamassassin/trunk: lib/Mail/SpamAssassin rules
Author: quinlan
Date: Wed Feb 4 00:09:34 2004
New Revision: 6493
Modified:
incubator/spamassassin/trunk/lib/Mail/SpamAssassin/HTML.pm
incubator/spamassassin/trunk/lib/Mail/SpamAssassin/MsgContainer.pm
incubator/spamassassin/trunk/rules/20_html_tests.cf
incubator/spamassassin/trunk/rules/70_cvs_rules_under_test.cf
Log:
Promote one of the parser-based HTML obfuscation rule sets
(not quite the best results, but seems least easily evaded).
This blows OBFUSCATING_COMMENT out of the water, by the way.
Modified: incubator/spamassassin/trunk/lib/Mail/SpamAssassin/HTML.pm
==============================================================================
--- incubator/spamassassin/trunk/lib/Mail/SpamAssassin/HTML.pm (original)
+++ incubator/spamassassin/trunk/lib/Mail/SpamAssassin/HTML.pm Wed Feb 4 00:09:34 2004
@@ -693,20 +693,11 @@
$text =~ s/^\n//s if $self->{html_last_tag} eq "br";
if (defined $self->{html_text}[-1]) {
- my $before = $self->{html_text}[-1];
- if ($before =~ /\S$/s && $text =~ /^\S/s) {
- $self->{html}{t_obfu_nspc}++;
- $self->{html}{t_obfu_nfmt}++ if $self->{html_last_tag} !~ /^(?:strong|b|em|font|a|u|span|sup|i)/;
- }
- else {
- $self->{html}{t_nonobfu_nspc}++;
- }
- if ($before =~ /\w$/s && $text =~ /^\w/s) {
- $self->{html}{t_obfu_word}++;
- $self->{html}{t_obfu_wfmt}++ if $self->{html_last_tag} !~ /^(?:strong|b|em|font|a|u|span|sup|i)/;
- }
- else {
- $self->{html}{t_nonobfu_word}++;
+ # ideas discarded since they would be easy to evade:
+ # 1. using \w instead of \S
+ # 2. exempting certain tags
+ if ($self->{html_text}[-1] =~ /\S$/s && $text =~ /^\S/s) {
+ $self->{html}{obfuscation}++;
}
}
Modified: incubator/spamassassin/trunk/lib/Mail/SpamAssassin/MsgContainer.pm
==============================================================================
--- incubator/spamassassin/trunk/lib/Mail/SpamAssassin/MsgContainer.pm (original)
+++ incubator/spamassassin/trunk/lib/Mail/SpamAssassin/MsgContainer.pm Wed Feb 4 00:09:34 2004
@@ -303,17 +303,10 @@
$self->{html_results}{t_bad_tag_unique_ratio} = ($self->{html_results}{tags_seen} - $self->{html_results}{elements_seen}) / $self->{html_results}{tags_seen};
$self->{html_results}{t_bad_tag_unique_count} = ($self->{html_results}{tags_seen} - $self->{html_results}{elements_seen});
}
- if (exists $self->{html_results}{tags}) {
- $self->{html_results}{t_obfu_nspc_ratio} = $self->{html_results}{t_obfu_nspc} / $self->{html_results}{tags} if defined $self->{html_results}{t_obfu_nspc};
- $self->{html_results}{t_obfu_word_ratio} = $self->{html_results}{t_obfu_word} / $self->{html_results}{tags} if defined $self->{html_results}{t_obfu_word};
- $self->{html_results}{t_obfu_nfmt_ratio} = $self->{html_results}{t_obfu_nfmt} / $self->{html_results}{tags} if defined $self->{html_results}{t_obfu_nfmt};
- $self->{html_results}{t_obfu_wfmt_ratio} = $self->{html_results}{t_obfu_wfmt} / $self->{html_results}{tags} if defined $self->{html_results}{t_obfu_wfmt};
- }
- if (exists $self->{html_results}{t_obfu_word} && exists $self->{html_results}{t_nonobfu_word}) {
- $self->{html_results}{t_obfu_word2_ratio} = $self->{html_results}{t_obfu_word} / ($self->{html_results}{t_obfu_word} + $self->{html_results}{t_nonobfu_word});
- }
- if (exists $self->{html_results}{t_obfu_nspc} && exists $self->{html_results}{t_nonobfu_nspc}) {
- $self->{html_results}{t_obfu_nspc2_ratio} = $self->{html_results}{t_obfu_nspc} / ($self->{html_results}{t_obfu_nspc} + $self->{html_results}{t_nonobfu_nspc});
+ if (exists $self->{html_results}{tags} &&
+ exists $self->{html_results}{obfuscation})
+ {
+ $self->{html_results}{obfuscation_ratio} = $self->{html_results}{obfuscation} / $self->{html_results}{tags};
}
}
else {
Modified: incubator/spamassassin/trunk/rules/20_html_tests.cf
==============================================================================
--- incubator/spamassassin/trunk/rules/20_html_tests.cf (original)
+++ incubator/spamassassin/trunk/rules/20_html_tests.cf Wed Feb 4 00:09:34 2004
@@ -208,6 +208,18 @@
body HTML_LINK_CLICK_CAPS eval:html_eval('anchor_text', '=~ /CLICK/')
describe HTML_LINK_CLICK_CAPS HTML link text says "CLICK"
+# HTML obfuscation
+body HTML_OBFUSCATION_00_10 eval:html_range('obfuscation_ratio','.0','.1')
+body HTML_OBFUSCATION_10_20 eval:html_range('obfuscation_ratio','.1','.2')
+body HTML_OBFUSCATION_20_30 eval:html_range('obfuscation_ratio','.2','.3')
+body HTML_OBFUSCATION_30_40 eval:html_range('obfuscation_ratio','.3','.4')
+body HTML_OBFUSCATION_40_50 eval:html_range('obfuscation_ratio','.4','.5')
+body HTML_OBFUSCATION_50_60 eval:html_range('obfuscation_ratio','.5','.6')
+body HTML_OBFUSCATION_60_70 eval:html_range('obfuscation_ratio','.6','.7')
+body HTML_OBFUSCATION_70_80 eval:html_range('obfuscation_ratio','.7','.8')
+body HTML_OBFUSCATION_80_90 eval:html_range('obfuscation_ratio','.8','.9')
+body HTML_OBFUSCATION_90_100 eval:html_range('obfuscation_ratio','.9','1.0')
+
# many spammers seem to do this nowadays (and probably track
# their customers with it). (contrib: WW)
body HTML_RELAYING_FRAME eval:html_test('relaying_frame')
Modified: incubator/spamassassin/trunk/rules/70_cvs_rules_under_test.cf
==============================================================================
--- incubator/spamassassin/trunk/rules/70_cvs_rules_under_test.cf (original)
+++ incubator/spamassassin/trunk/rules/70_cvs_rules_under_test.cf Wed Feb 4 00:09:34 2004
@@ -485,69 +485,3 @@
header T_MSGID_SPAM_3_7 Message-Id =~ /<[a-z]{7,}\@(\S+\.)+\S+>/
describe T_MSGID_SPAM_3_7 Message-ID has known spammer pattern
-# parser-based HTML obfuscation
-body T_HTML_OBFU_WORD_00_10 eval:html_range('t_obfu_word_ratio','0.00','0.10')
-body T_HTML_OBFU_WORD_10_20 eval:html_range('t_obfu_word_ratio','0.10','0.20')
-body T_HTML_OBFU_WORD_20_30 eval:html_range('t_obfu_word_ratio','0.20','0.30')
-body T_HTML_OBFU_WORD_30_40 eval:html_range('t_obfu_word_ratio','0.30','0.40')
-body T_HTML_OBFU_WORD_40_50 eval:html_range('t_obfu_word_ratio','0.40','0.50')
-body T_HTML_OBFU_WORD_50_60 eval:html_range('t_obfu_word_ratio','0.50','0.60')
-body T_HTML_OBFU_WORD_60_70 eval:html_range('t_obfu_word_ratio','0.60','0.70')
-body T_HTML_OBFU_WORD_70_80 eval:html_range('t_obfu_word_ratio','0.70','0.80')
-body T_HTML_OBFU_WORD_80_90 eval:html_range('t_obfu_word_ratio','0.80','0.90')
-body T_HTML_OBFU_WORD_90_100 eval:html_range('t_obfu_word_ratio','0.90','1.00')
-
-body T_HTML_OBFU_NSPC_00_10 eval:html_range('t_obfu_nspc_ratio','0.00','0.10')
-body T_HTML_OBFU_NSPC_10_20 eval:html_range('t_obfu_nspc_ratio','0.10','0.20')
-body T_HTML_OBFU_NSPC_20_30 eval:html_range('t_obfu_nspc_ratio','0.20','0.30')
-body T_HTML_OBFU_NSPC_30_40 eval:html_range('t_obfu_nspc_ratio','0.30','0.40')
-body T_HTML_OBFU_NSPC_40_50 eval:html_range('t_obfu_nspc_ratio','0.40','0.50')
-body T_HTML_OBFU_NSPC_50_60 eval:html_range('t_obfu_nspc_ratio','0.50','0.60')
-body T_HTML_OBFU_NSPC_60_70 eval:html_range('t_obfu_nspc_ratio','0.60','0.70')
-body T_HTML_OBFU_NSPC_70_80 eval:html_range('t_obfu_nspc_ratio','0.70','0.80')
-body T_HTML_OBFU_NSPC_80_90 eval:html_range('t_obfu_nspc_ratio','0.80','0.90')
-body T_HTML_OBFU_NSPC_90_100 eval:html_range('t_obfu_nspc_ratio','0.90','1.00')
-
-body T_HTML_OBFU_WFMT_00_10 eval:html_range('t_obfu_wfmt_ratio','0.00','0.10')
-body T_HTML_OBFU_WFMT_10_20 eval:html_range('t_obfu_wfmt_ratio','0.10','0.20')
-body T_HTML_OBFU_WFMT_20_30 eval:html_range('t_obfu_wfmt_ratio','0.20','0.30')
-body T_HTML_OBFU_WFMT_30_40 eval:html_range('t_obfu_wfmt_ratio','0.30','0.40')
-body T_HTML_OBFU_WFMT_40_50 eval:html_range('t_obfu_wfmt_ratio','0.40','0.50')
-body T_HTML_OBFU_WFMT_50_60 eval:html_range('t_obfu_wfmt_ratio','0.50','0.60')
-body T_HTML_OBFU_WFMT_60_70 eval:html_range('t_obfu_wfmt_ratio','0.60','0.70')
-body T_HTML_OBFU_WFMT_70_80 eval:html_range('t_obfu_wfmt_ratio','0.70','0.80')
-body T_HTML_OBFU_WFMT_80_90 eval:html_range('t_obfu_wfmt_ratio','0.80','0.90')
-body T_HTML_OBFU_WFMT_90_100 eval:html_range('t_obfu_wfmt_ratio','0.90','1.00')
-
-body T_HTML_OBFU_NFMT_00_10 eval:html_range('t_obfu_nfmt_ratio','0.00','0.10')
-body T_HTML_OBFU_NFMT_10_20 eval:html_range('t_obfu_nfmt_ratio','0.10','0.20')
-body T_HTML_OBFU_NFMT_20_30 eval:html_range('t_obfu_nfmt_ratio','0.20','0.30')
-body T_HTML_OBFU_NFMT_30_40 eval:html_range('t_obfu_nfmt_ratio','0.30','0.40')
-body T_HTML_OBFU_NFMT_40_50 eval:html_range('t_obfu_nfmt_ratio','0.40','0.50')
-body T_HTML_OBFU_NFMT_50_60 eval:html_range('t_obfu_nfmt_ratio','0.50','0.60')
-body T_HTML_OBFU_NFMT_60_70 eval:html_range('t_obfu_nfmt_ratio','0.60','0.70')
-body T_HTML_OBFU_NFMT_70_80 eval:html_range('t_obfu_nfmt_ratio','0.70','0.80')
-body T_HTML_OBFU_NFMT_80_90 eval:html_range('t_obfu_nfmt_ratio','0.80','0.90')
-body T_HTML_OBFU_NFMT_90_100 eval:html_range('t_obfu_nfmt_ratio','0.90','1.00')
-
-body T_HTML_OBFU_WORD2_00_10 eval:html_range('t_obfu_word2_ratio','0.00','0.10')
-body T_HTML_OBFU_WORD2_10_20 eval:html_range('t_obfu_word2_ratio','0.10','0.20')
-body T_HTML_OBFU_WORD2_20_30 eval:html_range('t_obfu_word2_ratio','0.20','0.30')
-body T_HTML_OBFU_WORD2_30_40 eval:html_range('t_obfu_word2_ratio','0.30','0.40')
-body T_HTML_OBFU_WORD2_40_50 eval:html_range('t_obfu_word2_ratio','0.40','0.50')
-body T_HTML_OBFU_WORD2_50_60 eval:html_range('t_obfu_word2_ratio','0.50','0.60')
-body T_HTML_OBFU_WORD2_60_70 eval:html_range('t_obfu_word2_ratio','0.60','0.70')
-body T_HTML_OBFU_WORD2_70_80 eval:html_range('t_obfu_word2_ratio','0.70','0.80')
-body T_HTML_OBFU_WORD2_80_90 eval:html_range('t_obfu_word2_ratio','0.80','0.90')
-body T_HTML_OBFU_WORD2_90_100 eval:html_range('t_obfu_word2_ratio','0.90','1.00')
-
-body T_HTML_OBFU_NSPC2_00_10 eval:html_range('t_obfu_nspc2_ratio','0.00','0.10')
-body T_HTML_OBFU_NSPC2_10_20 eval:html_range('t_obfu_nspc2_ratio','0.10','0.20')
-body T_HTML_OBFU_NSPC2_20_30 eval:html_range('t_obfu_nspc2_ratio','0.20','0.30')
-body T_HTML_OBFU_NSPC2_30_40 eval:html_range('t_obfu_nspc2_ratio','0.30','0.40')
-body T_HTML_OBFU_NSPC2_40_50 eval:html_range('t_obfu_nspc2_ratio','0.40','0.50')
-body T_HTML_OBFU_NSPC2_50_60 eval:html_range('t_obfu_nspc2_ratio','0.50','0.60')
-body T_HTML_OBFU_NSPC2_60_70 eval:html_range('t_obfu_nspc2_ratio','0.60','0.70')
-body T_HTML_OBFU_NSPC2_70_80 eval:html_range('t_obfu_nspc2_ratio','0.70','0.80')
-body T_HTML_OBFU_NSPC2_80_90 eval:html_range('t_obfu_nspc2_ratio','0.80','0.90')
-body T_HTML_OBFU_NSPC2_90_100 eval:html_range('t_obfu_nspc2_ratio','0.90','1.00')