You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by pd...@apache.org on 2019/08/31 08:57:17 UTC
svn commit: r1866196 - /spamassassin/trunk/rulesrc/sandbox/pds/20_php.cf
Author: pds
Date: Sat Aug 31 08:57:17 2019
New Revision: 1866196
URL: http://svn.apache.org/viewvc?rev=1866196&view=rev
Log:
SHORT_URL metas
Modified:
spamassassin/trunk/rulesrc/sandbox/pds/20_php.cf
Modified: spamassassin/trunk/rulesrc/sandbox/pds/20_php.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/pds/20_php.cf?rev=1866196&r1=1866195&r2=1866196&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/pds/20_php.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/pds/20_php.cf Sat Aug 31 08:57:17 2019
@@ -27,3 +27,15 @@ meta PDS_X_PHP_WELLKNOWN __PDS_X_PHP
describe PDS_X_PHP_WELLKNOWN X-PHP-Script shows sent from a PHP script in the /.well-known/ dir
score PDS_X_PHP_WELLKNOWN 1.0
reuse PDS_X_PHP_WELLKNOWN
+
+meta __PDS_SHORT_URL __SHORT_URL && !(__URL_SHORTENER || __PDS_URISHORTENER) && !ALL_TRUSTED
+
+meta PDS_PHPE_SHORT_URL __PDS_SHORT_URL && (__PDS_PHP_EVAL1 || __PDS_PHP_EVAL2)
+describe PDS_PHPE_SHORT_URL Short URL that isn't a shortener and sent by PHP exploit
+score PDS_PHPE_SHORT_URL 2.0 # limit
+reuse PDS_PHPE_SHORT_URL
+
+meta PDS_PHPE_URISHORTENER (__PDS_PHP_EVAL1 || __PDS_PHP_EVAL2) && (__URL_SHORTENER || __PDS_URISHORTENER)
+describe PDS_PHPE_URISHORTENER URI Shortener with PHP eval
+score PDS_PHPE_URISHORTENER 2.0 # limit
+reuse PDS_PHPE_URISHORTENER