[Bug 4883] new rules: span float obfuscation

[bu...@bugzilla.spamassassin.org]

http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4883





------- Additional Comments From mbr@freebsd.org  2006-05-01 11:58 -------
(From update of attachment 3495)
Match the newest variants too ...

rawbody __A_HTML	/> *A *</i
rawbody __B_HTML	/> *B *</i
rawbody __C_HTML	/> *C *</i
rawbody __D_HTML	/> *D *</i
rawbody __E_HTML	/> *E *</i
rawbody __F_HTML	/> *F *</i
rawbody __G_HTML	/> *G *</i
rawbody __H_HTML	/> *H *</i
rawbody __I_HTML	/> *I *</i
rawbody __J_HTML	/> *J *</i
rawbody __K_HTML	/> *K *</i
rawbody __L_HTML	/> *L *</i
rawbody __M_HTML	/> *M *</i
rawbody __N_HTML	/> *N *</i
rawbody __O_HTML	/> *O *</i
rawbody __P_HTML	/> *P *</i
rawbody __Q_HTML	/> *Q *</i
rawbody __R_HTML	/> *R *</i
rawbody __S_HTML	/> *S *</i
rawbody __T_HTML	/> *T *</i
rawbody __U_HTML	/> *U *</i
rawbody __V_HTML	/> *V *</i
rawbody __W_HTML	/> *W *</i
rawbody __X_HTML	/> *X *</i
rawbody __Y_HTML	/> *Y *</i
rawbody __Z_HTML	/> *Z *</i
rawbody __DOLLAR_HTML	/> *\$[0-9]+ *</i

meta		SCHAR_HTML_1	(__DOLLAR_HTML || __TM2_MISC_INVISI_COLOR) &&
(__A_HTML + __B_HTML + __C_HTML + __D_HTML + __E_HTML + __F_HTML + __G_HTML +
__H_HTML + __I_HTML + __J_HTML + __K_HTML + __L_HTML + __M_HTML + __N_HTML +
__O_HTML + __P_HTML + __Q_HTML + __R_HTML + __S_HTML + __T_HTML + __U_HTML +
__V_HTML + __W_HTML + __W_HTML + __X_HTML + __Y_HTML + __Z_HTML >= 5)
score		SCHAR_HTML_1		0.500
describe	SCHAR_HTML_1		Obfuscated HTML (5)

meta		SCHAR_HTML_2	(__DOLLAR_HTML || __TM2_MISC_INVISI_COLOR) &&
(__A_HTML + __B_HTML + __C_HTML + __D_HTML + __E_HTML + __F_HTML + __G_HTML +
__H_HTML + __I_HTML + __J_HTML + __K_HTML + __L_HTML + __M_HTML + __N_HTML +
__O_HTML + __P_HTML + __Q_HTML + __R_HTML + __S_HTML + __T_HTML + __U_HTML +
__V_HTML + __W_HTML + __W_HTML + __X_HTML + __Y_HTML + __Z_HTML >= 10)
score		SCHAR_HTML_2		2.000
describe	SCHAR_HTML_2		Obfuscated HTML (10)

meta		SCHAR_HTML_3	(__DOLLAR_HTML || __TM2_MISC_INVISI_COLOR) &&
(__A_HTML + __B_HTML + __C_HTML + __D_HTML + __E_HTML + __F_HTML + __G_HTML +
__H_HTML + __I_HTML + __J_HTML + __K_HTML + __L_HTML + __M_HTML + __N_HTML +
__O_HTML + __P_HTML + __Q_HTML + __R_HTML + __S_HTML + __T_HTML + __U_HTML +
__V_HTML + __W_HTML + __W_HTML + __X_HTML + __Y_HTML + __Z_HTML >= 15)
score		SCHAR_HTML_3		5.000
describe	SCHAR_HTML_3		Obfuscated HTML (15)

full		OBFU_FLOAT		/<(?:span|font)[\t\s
]+style=.{1,20}[\s\t ]*float[\s\t ]*:[\s\t
]*right"[^>]*>[^<]+<\/(?:span|font)>/i
score		OBFU_FLOAT		5.000
describe	OBFU_FLOAT		Obfuscated SPAM with float style.

full		__OBFU_SPAN_1		/<span[^>]{1,100}>[a-z]<\/span>/i
full		__OBFU_SPAN_2		/<span[^>]{1,100}>[a-z]{2}<\/span>/i
full		__OBFU_SPAN_3		/<span[^>]{1,100}>[a-z]{3}<\/span>/i
full		__OBFU_SPAN_4		/<\/span><\/a>/i
meta		OBFU_SPAN_1		(__OBFU_SPAN_1 + __OBFU_SPAN_2 +
__OBFU_SPAN_3 - __OBFU_SPAN_4 == 3)
meta		OBFU_SPAN_2		(__OBFU_SPAN_1 + __OBFU_SPAN_2 +
__OBFU_SPAN_3 + __OBFU_SPAN_4 == 4)
score		OBFU_SPAN_1		3.000
score		OBFU_SPAN_2		5.000
describe	OBFU_SPAN_1		Obfuscated SPAN tables
describe	OBFU_SPAN_2		Obfuscated SPAN tables with Link




------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.