You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by qu...@apache.org on 2004/03/03 04:32:49 UTC
svn commit: rev 6973 - in incubator/spamassassin/trunk: lib/Mail/SpamAssassin rules
Author: quinlan
Date: Tue Mar 2 19:32:47 2004
New Revision: 6973
Modified:
incubator/spamassassin/trunk/lib/Mail/SpamAssassin/EvalTests.pm
incubator/spamassassin/trunk/lib/Mail/SpamAssassin/HTML.pm
incubator/spamassassin/trunk/rules/20_head_tests.cf
incubator/spamassassin/trunk/rules/20_html_tests.cf
incubator/spamassassin/trunk/rules/70_testing.cf
Log:
share same eval test between HTML comments and HTML titles
promote new RCVD_DOUBLE_IP rules
promote T_MIME_BOUND_DIGITS15 to MIME_BOUND_DIGITS_15
demote T_RCVD_BY_IP
demote T_FAKED_IP_IN_RCVD
remove HTML_COMMENT_SKY
Modified: incubator/spamassassin/trunk/lib/Mail/SpamAssassin/EvalTests.pm
==============================================================================
--- incubator/spamassassin/trunk/lib/Mail/SpamAssassin/EvalTests.pm (original)
+++ incubator/spamassassin/trunk/lib/Mail/SpamAssassin/EvalTests.pm Tue Mar 2 19:32:47 2004
@@ -3312,10 +3312,10 @@
return exists $self->{html}{$test} && eval "qq{\Q$self->{html}{$test}\E} $expr";
}
-sub html_title {
- my ($self, undef, $expr) = @_;
- for my $title (@{ $self->{html}{title} }) {
- if (defined $title && eval "qq{\Q$title\E} $expr") {
+sub html_text {
+ my ($self, undef, $text, $expr) = @_;
+ for my $string (@{ $self->{html}{$text} }) {
+ if (defined $string && eval "qq{\Q$string\E} $expr") {
return 1;
}
}
Modified: incubator/spamassassin/trunk/lib/Mail/SpamAssassin/HTML.pm
==============================================================================
--- incubator/spamassassin/trunk/lib/Mail/SpamAssassin/HTML.pm (original)
+++ incubator/spamassassin/trunk/lib/Mail/SpamAssassin/HTML.pm Tue Mar 2 19:32:47 2004
@@ -995,7 +995,7 @@
sub html_comment {
my ($self, $text) = @_;
- $self->{html}{comment_text} .= "$text\n";
+ push @{ $self->{html}{comment} }, $text;
$self->{html}{total_comment_length} += length($text) + 7; # "<!--" + "-->"
if ($self->{html_last_tag} eq "div" &&
Modified: incubator/spamassassin/trunk/rules/20_head_tests.cf
==============================================================================
--- incubator/spamassassin/trunk/rules/20_head_tests.cf (original)
+++ incubator/spamassassin/trunk/rules/20_head_tests.cf Tue Mar 2 19:32:47 2004
@@ -303,12 +303,12 @@
header RCVD_NUMERIC_HELO Received =~ /helo[= ]\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/i
describe RCVD_NUMERIC_HELO Received: contains a numeric HELO
-header FAKED_IP_IN_RCVD Received =~ /from [-0-9a-z\._]+_\[\d+\.\d+\.\d+\.\d+\] /i
-describe FAKED_IP_IN_RCVD Received: contains a name with a faked IP-address
+header RCVD_DOUBLE_IP_SPAM Received =~ /from \[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\] by \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} with/
+describe RCVD_DOUBLE_IP_SPAM Bulk email fingerprint (double IP) found
-# no legit mailer claims that their mailserver has no name
-header RCVD_BY_IP Received =~ /from \S+ \[\S+\] by [0-9\.]+ with ESMTP id/
-describe RCVD_BY_IP Received by mail server with no name
+header __DOUBLE_IP_LOOSE Received =~ /(?:\b(?:from|by)\b.{1,4}\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}(?<!127\.0\.0\.1)\b.{0,4}){2}/i
+meta RCVD_DOUBLE_IP_LOOSE (!RCVD_DOUBLE_IP_SPAM && __DOUBLE_IP_LOOSE)
+describe RCVD_DOUBLE_IP_LOOSE Received: by and from look like IP addresses
header SMTPD_IN_RCVD Received =~ /\(SMTPD32-\d+\..+\)/
describe SMTPD_IN_RCVD Received via SMTPD32 server (SMTPD32-n.n)
@@ -567,6 +567,8 @@
describe MIME_BOUND_DIGITS_4 Spam tool pattern in MIME boundary
header MIME_BOUND_DIGITS_7 Content-Type =~ /boundary=\d{9}\.\d{13}/
describe MIME_BOUND_DIGITS_7 Spam tool pattern in MIME boundary
+header MIME_BOUND_DIGITS_15 Content-Type =~ /boundary=\"\d{15,}\"/
+describe MIME_BOUND_DIGITS_15 Spam tool pattern in MIME boundary
header MIME_BOUND_HEX_24 Content-Type =~ /boundary=\"[\dA-F]{24}\"/
describe MIME_BOUND_HEX_24 Spam tool pattern in MIME boundary
header MIME_BOUND_MA Content-Type =~ /boundary=\"----=_[a-zA-Z0-9]{8}_[a-zA-Z0-9]{8}_MA\"/
Modified: incubator/spamassassin/trunk/rules/20_html_tests.cf
==============================================================================
--- incubator/spamassassin/trunk/rules/20_html_tests.cf (original)
+++ incubator/spamassassin/trunk/rules/20_html_tests.cf Tue Mar 2 19:32:47 2004
@@ -76,19 +76,16 @@
describe HTML_TABLE_THICK_BORD HTML table has thick border
# HTML comment tests
-body HTML_COMMENT_EMAIL eval:html_eval('comment_text', '=~ /\S+\@\S+/')
+body HTML_COMMENT_EMAIL eval:html_text('comment', '=~ /\S+\@\S+/')
describe HTML_COMMENT_EMAIL HTML comment contains email address
body HTML_COMMENT_SHOUTING eval:html_test('comment_shouting')
describe HTML_COMMENT_SHOUTING HTML comment inside of "shouting" markup
-body HTML_COMMENT_SKY eval:html_eval('comment_text', '=~ /SKY-(?:Email-Address|Database|Mailing|List)/')
-describe HTML_COMMENT_SKY HTML comment contains SKY database codes
-
-body HTML_COMMENT_8BITS eval:html_eval('comment_text', '=~ /[\x80-\xff]{3,}/')
+body HTML_COMMENT_8BITS eval:html_text('comment', '=~ /[\x80-\xff]{3,}/')
describe HTML_COMMENT_8BITS HTML comment has 3 consecutive 8-bit chars
-body HTML_COMMENT_SAVED_URL eval:html_eval('comment_text', '=~ /<!-- saved from url=\(\d{4}\)/')
+body HTML_COMMENT_SAVED_URL eval:html_text('comment', '=~ /<!-- saved from url=\(\d{4}\)/')
describe HTML_COMMENT_SAVED_URL HTML message is a saved web page
# Comment is a spam sign when following <DIV>
@@ -322,13 +319,13 @@
describe HTML_NONELEMENT_80_90 80% to 90% of HTML elements are non-standard
describe HTML_NONELEMENT_90_100 90% to 100% of HTML elements are non-standard
-body HTML_TITLE_EMPTY eval:html_title('!~ /\S/s')
+body HTML_TITLE_EMPTY eval:html_text('title', '!~ /\S/s')
describe HTML_TITLE_EMPTY HTML title contains no text
body HTML_TITLE_EXTRA eval:html_test('title_extra')
describe HTML_TITLE_EXTRA HTML has more than one title
-body HTML_TITLE_UNTITLED eval:html_title('=~ /untitled|new page \d+/i')
+body HTML_TITLE_UNTITLED eval:html_text('title', '=~ /untitled|new page \d+/i')
describe HTML_TITLE_UNTITLED HTML title contains "Untitled"
###########################################################################
Modified: incubator/spamassassin/trunk/rules/70_testing.cf
==============================================================================
--- incubator/spamassassin/trunk/rules/70_testing.cf (original)
+++ incubator/spamassassin/trunk/rules/70_testing.cf Tue Mar 2 19:32:47 2004
@@ -360,36 +360,6 @@
# pool-151-203-32-68.bos.east.verizon.net [151.203.32.68]
# 12-218-225-223.client.mchsi.com [12.218.225.223]
-# bug 2992: Proposed new rules, Martin Radford
-header T_RCVD_DOUBLE_IP_SPAM Received =~ /from \[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\] by \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} with/
-describe T_RCVD_DOUBLE_IP_SPAM Bulk email fingerprint (double IP) found
-
-# some looser variants
-header __DOUBLE_IP_LOOSE_A Received =~ /\b(?:from|by)\b.{1,4}\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}(?<!127\.0\.0\.1)\b.{1,4}\b(?:by|from)\b.{1,4}\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}(?<!127\.0\.0\.1)\b/i
-meta T_RCVD_DOUBLE_IP_LOOSE_A (!T_RCVD_DOUBLE_IP_SPAM && __DOUBLE_IP_LOOSE_A)
-describe T_RCVD_DOUBLE_IP_LOOSE_A Received: by and from are both IP addresses
-
-# should be the same as A except shorter
-header __DOUBLE_IP_LOOSE_B Received =~ /(?:\b(?:from|by)\b.{1,4}\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}(?<!127\.0\.0\.1)\b.{0,4}){2}/i
-meta T_RCVD_DOUBLE_IP_LOOSE_B (!T_RCVD_DOUBLE_IP_SPAM && __DOUBLE_IP_LOOSE_B)
-describe T_RCVD_DOUBLE_IP_LOOSE_B Received: by and from are both IP addresses
-
-# longer distances between from and by
-header __DOUBLE_IP_LOOSE_C Received =~ /(?:\b(?:from|by)\b.{1,4}\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}(?<!127\.0\.0\.1)\b.{0,32}){2}/i
-meta T_RCVD_DOUBLE_IP_LOOSE_C (!T_RCVD_DOUBLE_IP_SPAM && __DOUBLE_IP_LOOSE_C)
-describe T_RCVD_DOUBLE_IP_LOOSE_C Received: by and from are both IP addresses
-
-header __DOUBLE_IP_LOOSE_D Received =~ /(?:\b(?:from|by)\b.{1,4}\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}(?<!127\.0\.0\.1)\b.{0,64}){2}/i
-meta T_RCVD_DOUBLE_IP_LOOSE_D (!T_RCVD_DOUBLE_IP_SPAM && __DOUBLE_IP_LOOSE_D)
-describe T_RCVD_DOUBLE_IP_LOOSE_D Received: by and from are both IP addresses
-
-header __DOUBLE_IP_LOOSE_E Received =~ /(?:\b(?:from|by)\b.{1,4}\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}(?<!127\.0\.0\.1)\b.*){2}/i
-meta T_RCVD_DOUBLE_IP_LOOSE_E (!T_RCVD_DOUBLE_IP_SPAM && __DOUBLE_IP_LOOSE_E)
-describe T_RCVD_DOUBLE_IP_LOOSE_E Received: by and from are both IP addresses
-
-header T_MIME_BOUND_DIGITS15 Content-Type =~ /boundary=\"\d{15,}\"/
-describe T_MIME_BOUND_DIGITS15 MIME boundary contains all digits
-
# some simple subject rules to catch a persistent spammer
header T_SUBJ_XANAX Subject =~ /x.{0,2}a.{0,2}n.{0,2}a.{0,2}x/i
header T_SUBJ_VALIUM Subject =~ /v.{0,2}a.{0,2}l.{0,2}i.{0,2}u.{0,2}m/i
@@ -576,5 +546,28 @@
header T_FAKED_AUTHWARN_2 X-Authentication-Warning !~ /^(\S+\.\S+): / [if-unset: host.example.net: foo owned process doing -bs]
-body T_HTML_COMMENT_TAG eval:html_eval('comment_text', '=~ /<.*?>/')
+body T_HTML_COMMENT_TAG eval:html_text('comment', '=~ /<.*?>/')
describe T_HTML_COMMENT_TAG HTML comment probably contains HTML tag
+
+# back to the drawing board (demoted for development or deletion)
+header T_FAKED_IP_IN_RCVD Received =~ /from [-0-9a-z\._]+_\[\d+\.\d+\.\d+\.\d+\] /i
+describe T_FAKED_IP_IN_RCVD Received: contains a name with a faked IP-address
+
+# back to the drawing board (demoted for development or deletion)
+# no legit mailer claims that their mailserver has no name
+header T_RCVD_BY_IP Received =~ /from \S+ \[\S+\] by [0-9\.]+ with ESMTP id/
+describe T_RCVD_BY_IP Received by mail server with no name
+
+header T_RCVD_BY_IP_2 Received =~ /from \S+ \[\S+\] by [0-9\.]+ with/
+header T_RCVD_BY_IP_3 Received =~ /\bby [0-9\.]+ with/
+header T_RCVD_BY_IP_4 Received =~ /\bby\s+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s+with/
+header T_RCVD_BY_IP_5 Received =~ /\bby\s+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s+with/
+header T_RCVD_BY_IP_6 Received =~ /\bby\s+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s+with/
+header T_RCVD_BY_IP_7 Received =~ /\bby\b.{1,4}\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}(?<!127\.0\.0\.1)\b/i
+header T_RCVD_BY_IP_8 Received =~ /\bby\b.{1,4}\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}\b/i
+header T_RCVD_BY_IP_9 Received =~ /\bby\b.{1,4}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?<!127\.0\.0\.1)\b/i
+header T_RCVD_BY_IP_A Received =~ /\bby\b.{1,4}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/i
+header T_RCVD_BY_IP_B Received =~ /\bby\b\s*.{0,2}\s*\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}(?<!127\.0\.0\.1)\b/i
+header T_RCVD_BY_IP_C Received =~ /\bby\b\s*.{0,2}\s*\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}\b/i
+header T_RCVD_BY_IP_D Received =~ /\bby\b\s*.{0,2}\s*\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?<!127\.0\.0\.1)\b/i
+header T_RCVD_BY_IP_E Received =~ /\bby\b\s*.{0,2}\s*\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/i