You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2020/11/11 05:07:36 UTC
svn commit: r1883298 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Wed Nov 11 05:07:36 2020
New Revision: 1883298
URL: http://svn.apache.org/viewvc?rev=1883298&view=rev
Log:
Add firebase to __URI_GOOG_STO_HTML, used in phishing
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1883298&r1=1883297&r2=1883298&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Wed Nov 11 05:07:36 2020
@@ -3224,7 +3224,7 @@ tflags URI_DASHGOVEDU p
uri __URI_GOOG_STO_IMG m,^https?://storage\.googleapis\.com/.*\.(?:png|jpe?g|gif)$,i
tflags __URI_GOOG_STO_IMG multiple maxhits=5
-uri __URI_GOOG_STO_HTML m,^https?://storage\.googleapis\.com/.*\.html?$,i
+uri __URI_GOOG_STO_HTML m,^https?://(?:firebase)?storage\.googleapis\.com/.*\.html?(?:$|\?),i
tflags __URI_GOOG_STO_HTML multiple maxhits=5
meta __GOOG_STO_IMG_NOHTML __URI_GOOG_STO_IMG && !__URI_GOOG_STO_HTML