You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by fe...@apache.org on 2007/07/08 08:38:17 UTC
svn commit: r554326 - /spamassassin/rules/trunk/sandbox/felicity/70_other.cf
Author: felicity
Date: Sat Jul 7 23:38:16 2007
New Revision: 554326
URL: http://svn.apache.org/viewvc?view=rev&rev=554326
Log:
settle pdf rules down to #27
Modified:
spamassassin/rules/trunk/sandbox/felicity/70_other.cf
Modified: spamassassin/rules/trunk/sandbox/felicity/70_other.cf
URL: http://svn.apache.org/viewvc/spamassassin/rules/trunk/sandbox/felicity/70_other.cf?view=diff&rev=554326&r1=554325&r2=554326
==============================================================================
--- spamassassin/rules/trunk/sandbox/felicity/70_other.cf (original)
+++ spamassassin/rules/trunk/sandbox/felicity/70_other.cf Sat Jul 7 23:38:16 2007
@@ -339,56 +339,17 @@
body TVD_STOCK1 eval:check_stock_info('2')
endif
+# don't use body
+rawbody __TVD_BODY /\S{4}/
-# fine, let's aim at some of the PDF spam that's around these days
-
-# 3.366 3.6797 1.3100 0.737 0.59 0.00 TVD_PDF_01
-# 0.919 1.0598 0.0000 1.000 0.61 0.00 TVD_PDF_02
-# 1.597 1.8161 0.1611 0.919 0.86 0.00 TVD_PDF_03
-# 0.919 1.0598 0.0000 1.000 0.61 0.00 TVD_PDF_20
-header T_TVD_PDF_01 Message-Id =~ /<[0-9A-F]{8}\.\d{7}\@/
-header T_TVD_PDF_02 Subject =~ /\.pdf/
-header T_TVD_PDF_03 Content-Type =~ /boundary="-{12}\d{24}"/
-meta T_TVD_PDF_20 T_TVD_PDF_01 && T_TVD_PDF_02 && T_TVD_PDF_03
-
-# 0.919 1.0598 0.0000 1.000 0.61 0.00 TVD_PDF_21
-# 1.133 1.2977 0.0537 0.960 0.71 0.00 TVD_PDF_22
-# 0.919 1.0598 0.0000 1.000 0.61 0.00 TVD_PDF_23
-meta T_TVD_PDF_21 T_TVD_PDF_01 && T_TVD_PDF_02
-meta T_TVD_PDF_22 T_TVD_PDF_01 && T_TVD_PDF_03
-meta T_TVD_PDF_23 T_TVD_PDF_02 && T_TVD_PDF_03
-
-# 1.133 1.2977 0.0537 0.960 0.71 0.00 TVD_PDF_22B
-# 0.919 1.0598 0.0000 1.000 0.61 0.00 TVD_PDF_23B
-# 3.518 3.9094 0.9557 0.804 1.00 0.00 TVD_PDF_03B
-# 1.032 1.1894 0.0000 1.000 0.80 0.00 TVD_PDF_25B
-header T_TVD_PDF_03B Content-Type =~ /boundary="-{2,}\d{8,}"/
-meta T_TVD_PDF_22B T_TVD_PDF_01 && T_TVD_PDF_03B
-meta T_TVD_PDF_23B T_TVD_PDF_02 && T_TVD_PDF_03B
-meta T_TVD_PDF_25B T_TVD_PDF_22B && T_TVD_PDF_24
-
-# 1.035 1.1910 0.0107 0.991 0.76 0.00 __TVD_PDF_ATT_AP
-# 74.260 77.0441 56.0399 0.579 0.51 0.00 __TVD_PDF_ATT_TP
-# 2.051 1.5519 5.3152 0.226 0.00 0.00 __TVD_PDF_CT_MM
-# 1.035 1.1910 0.0107 0.991 0.76 0.00 TVD_PDF_24
-# 0.001 0.0016 0.0000 1.000 0.43 0.00 TVD_PDF_25
-header __TVD_PDF_CT_MM Content-Type =~ /^multipart\/mixed/i
+## look for specific content-types
+header __TVD_MIME_CT_MM Content-Type =~ /^multipart\/mixed/i
ifplugin Mail::SpamAssassin::Plugin::MIMEEval
-mimeheader __TVD_PDF_ATT_TP Content-Type =~ /^text\/plain/i
-mimeheader __TVD_PDF_ATT_AP Content-Type =~ /^application\/pdf/i
-mimeheader __TVD_PDF_ATT_AO Content-Type =~ /^application\/octet-stream/i
+mimeheader __TVD_MIME_ATT_TP Content-Type =~ /^text\/plain/i
+mimeheader __TVD_MIME_ATT_AP Content-Type =~ /^application\/pdf/i
+mimeheader __TVD_MIME_ATT_AOPDF Content-Type =~ /^application\/octet-stream.*\.pdf/i
endif
-meta T_TVD_PDF_24 __TVD_PDF_CT_MM && __TVD_PDF_ATT_TP && __TVD_PDF_ATT_AP
-meta T_TVD_PDF_25 T_TVD_PDF_22 && T_TVD_PDF_24
-
-# 1.032 1.1894 0.0000 1.000 0.80 0.00 TVD_PDF_26
-# 1.032 1.1894 0.0000 1.000 0.80 0.00 TVD_PDF_26B
-meta T_TVD_PDF_26 __TVD_PDF_CT_MM && T_TVD_PDF_03 && __TVD_PDF_ATT_AP
-meta T_TVD_PDF_26B __TVD_PDF_CT_MM && T_TVD_PDF_03B && __TVD_PDF_ATT_AP
-meta T_TVD_PDF_26C __TVD_PDF_CT_MM && T_TVD_PDF_03B && ( __TVD_PDF_ATT_AP || __TVD_PDF_ATT_AO )
+meta __TVD_MIME_ATT __TVD_MIME_ATT_AP || __TVD_MIME_ATT_AOPDF
-# 98.910 98.7434 100.0000 0.497 0.00 0.00 __TVD_PDF_04
-# 1.025 1.1812 0.0000 1.000 0.00 0.00 TVD_PDF_27
-# body fails due to subject ...
-rawbody __TVD_PDF_04 /\S{4}/
-meta T_TVD_PDF_27 __TVD_PDF_CT_MM && __TVD_PDF_ATT_TP && __TVD_PDF_ATT_AP && !__TVD_PDF_04
+meta T_TVD_PDF_27 __TVD_MIME_CT_MM && __TVD_MIME_ATT_TP && __TVD_MIME_ATT_AP && !__TVD_BODY
+meta T_TVD_PDF_27B __TVD_MIME_CT_MM && __TVD_MIME_ATT_TP && __TVD_MIME_ATT && !__TVD_BODY