You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2010/11/25 23:55:30 UTC
svn commit: r1039212 - in /spamassassin/trunk/rulesrc/sandbox/jhardin:
20_fillform.cf 20_lotsa_money.cf 20_misc_testing.cf 20_tbird_image_spam.cf
Author: jhardin
Date: Thu Nov 25 22:55:30 2010
New Revision: 1039212
URL: http://svn.apache.org/viewvc?rev=1039212&view=rev
Log:
Tweak fillform and lotsa_money, add more FP avoidance
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf
spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
spamassassin/trunk/rulesrc/sandbox/jhardin/20_tbird_image_spam.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf?rev=1039212&r1=1039211&r2=1039212&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf Thu Nov 25 22:55:30 2010
@@ -16,7 +16,7 @@
ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
# Repetitive syntactic bits
- replace_tag FF_LNNO (?:(?:\d{1,3}[)}\]:.,]{1,80}|\W?\([\div]{1,5}\)|\W?\{\d{1,3}\}|\[\d{1,3}\]|\*{1,5}|\#{1,5}|\(?[A-K][)}\]:.,]{1,3})\s?)
+ replace_tag FF_LNNO (?:(?:\d{1,3}(?:[)}\]:.,]{1,80}|(?:st|nd|rd|th)[)}\]:.,]{0,3})|\W?\([\div]{1,5}\)|\W?\{\d{1,3}\}|\[\d{1,3}\]|\*{1,5}|\#{1,5}|\(?[A-K][)}\]:.,]{1,3})\s?)
replace_tag FF_YOUR (?:a?\s?copy\sof\s)?(?:(?:your|din)[\s,:]{1,5})?(?:present\s|c[uo]rrent\s|full\s?|complete\s|direct\s|private\s|valid\s|personal\s){0,3}
replace_tag ANDOR (?:\s?[\/&+,]\s?|\sor\s|\sand?\s)
replace_tag NUMBER (?:num(?:[bm]er)?s?|nos?\.|no\b|\#s?|nbrs?\.?)
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf?rev=1039212&r1=1039211&r2=1039212&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf Thu Nov 25 22:55:30 2010
@@ -98,10 +98,10 @@ describe MONEY_LOTTERY Lots of money
score MONEY_LOTTERY 1.5
body __DEAL /\b(?:business|financial|this|the|mutual|die(?:se)?|cette|profitable)\s(?:deal|transa[ck]tion|proposal|offer|venture|suggestion|partnership)/i
-body __HUSH_HUSH /\b(?:confiden[tc]i[ae]l(?:\b|ity\b|it(?:[\xe9]|[\xc3][\xa9]))|private\b|secr[e\xe8](?:te?|cy)\b|sensitive\b|concealed\b|obscured\b|discre(?:et|tion)\b|vertraulich(?:en)?\b|geheim\b|priv(?:[\xe9]|[\xc3][\xa9]))/i
+body __HUSH_HUSH /\b(?:confiden[tc]i[ae]l(?:\b|ity\b|it(?:[\xe9]|[\xc3][\xa9]))|private\b|secr[e\xe8](?:te?|cy)\b|sensitive\b|concealed\b|obscured?\b|discre(?:et|tion)\b|vertraulich(?:en)?\b|geheim\b|priv(?:[\xe9]|[\xc3][\xa9]))/i
body __IS_LEGAL /\b(?:this\s(?:deal|offer|transaction|proposal|exchange|arrangement|work)|it)?\sis\s(?:(?:guaranteed|completely|absolutely|perfectly|100%|very|fully)\s)?(?:legal|hitch-free)\b/i
body __NOT_SCAM /\bnot\sa\sscam\b/i
-body __BACK_SCRATCH /\bmutual+y?\sbenefi(?:t|cial)\b/i
+body __BACK_SCRATCH /\bmutual+y?\s(?:benefi(?:t|cial)|interest)\b/i
body __LUCRATIVE /\b(?:lucrative|profitable|tr[\xe8]s\ssalutaire)\b/i
body __YOU_ASSIST /\byour\sassistance\b/i
body __OUR_BEHALF /\bon\s(?:my|our)\sbehalf\b/i
@@ -161,9 +161,9 @@ body __INHERIT_PMT /\binheritance
body __CONTACT_ATTY /\bcontact\smy\s(?:barrister|attou?rney)\b/i
body __TRTMT_DEFILED /\bdefiled\sall\s(?:forms\sof\s)?(?:medical\s)treatments?\b/i
-meta DECEASED_NO_ML __DECEASED && !__VIA_ML && !__UNSUB_LINK && !__HAS_THREAD_INDEX && !__THREAD_INDEX_GOOD && !__HS_SUBJ_RE_FW && !__IMS_MSGID && !__IS_EXCH
+meta DECEASED_NO_ML __DECEASED && !__VIA_ML && !__UNSUB_LINK && !__DOS_HAS_LIST_UNSUB && !__HAS_THREAD_INDEX && !__THREAD_INDEX_GOOD && !__HS_SUBJ_RE_FW && !__IMS_MSGID && !__IS_EXCH && !__COMMENT_EXISTS
describe DECEASED_NO_ML Dead not via mailing list
-tflags DECEASED_NO_ML nopublish
+#tflags DECEASED_NO_ML nopublish
body __WIRE_XFR /\b(?:wire|telegraph(?:ic)?|bank)\s?transfer/i
body __TRUSTED_CHECK /\b(?:cashier'?s?|certified)\sche(?:ck|que)/i
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1039212&r1=1039211&r2=1039212&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Thu Nov 25 22:55:30 2010
@@ -79,7 +79,7 @@ tflags FROM_MISSP_SPF_FAIL net
meta FROM_MISSP_EH_MATCH (__FROM_RUNON && __ENV_AND_HDR_FROM_MATCH) && !__RCD_RDNS_MTA_MESSY
describe FROM_MISSP_EH_MATCH From misspaced, matches envelope
-meta FROM_MISSP_URI (__FROM_RUNON && __HAS_ANY_URI) && !__NOT_SPOOFED && !__RCD_RDNS_MTA_MESSY
+meta FROM_MISSP_URI (__FROM_RUNON && __HAS_ANY_URI) && !__NOT_SPOOFED && !__RCD_RDNS_MTA_MESSY && !MISSING_MIMEOLE
describe FROM_MISSP_URI From misspaced, has URI
meta FROM_MISSP_USER (__FROM_RUNON && NSL_RCVD_FROM_USER)
@@ -366,7 +366,7 @@ endif
rawbody __STYLE_GIBBERISH /<style[^>]{0,30}>(?:\s{0,80}[^\s:;<]){150}/im
-meta STYLE_GIBBERISH __STYLE_GIBBERISH && !__THREADED && !__MIME_QP
+meta STYLE_GIBBERISH __STYLE_GIBBERISH && !__THREADED && !__MIME_QP && !__RCD_RDNS_MAIL_MESSY
body __SCRIPT_TAG_IN_BODY /<script>/i
rawbody __SCRIPT_GIBBERISH /<script>[^;<]{100}/im
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_tbird_image_spam.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_tbird_image_spam.cf?rev=1039212&r1=1039211&r2=1039212&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_tbird_image_spam.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_tbird_image_spam.cf Thu Nov 25 22:55:30 2010
@@ -33,7 +33,7 @@ meta TO_NO_BRKTS_HTML_IMG __TO_
score TO_NO_BRKTS_HTML_IMG 0.20
describe TO_NO_BRKTS_HTML_IMG To: misformatted and HTML and one image
-meta TO_NO_BRKTS_HTML_ONLY __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && MIME_HTML_ONLY && !__MIME_QP && !__MSGID_JAVAMAIL && !__HAS_X_MAILER && !__HAS_REPLY_TO && !__CTYPE_CHARSET_QUOTED && !__SUBJECT_ENCODED_B64
+meta TO_NO_BRKTS_HTML_ONLY __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && MIME_HTML_ONLY && !__MIME_QP && !__MSGID_JAVAMAIL && !__HAS_X_MAILER && !__HAS_REPLY_TO && !__CTYPE_CHARSET_QUOTED && !__SUBJECT_ENCODED_B64 && !__VIA_ML && !__MSGID_BEFORE_RECEIVED
score TO_NO_BRKTS_HTML_ONLY 0.20
describe TO_NO_BRKTS_HTML_ONLY To: misformatted and HTML only