You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2020/08/23 18:47:59 UTC
svn commit: r1881116 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Sun Aug 23 18:47:59 2020
New Revision: 1881116
URL: http://svn.apache.org/viewvc?rev=1881116&view=rev
Log:
Refinement of invisible HTML text rules, add some potential better-performing metas
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1881116&r1=1881115&r2=1881116&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Sun Aug 23 18:47:59 2020
@@ -2268,13 +2268,23 @@ endif
# rawbody __SPAN_INVIS /<span\s[^>]{0,200}style\s*=\s*"[^">]{0,80}(?:visibility\s*:\s*hidden\s*;|display\s*:\s*none\s*;)[^>]{1,200}>\w/i
if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
+ # Lots of ham uses invisible fonts - WHY?
rawbody __FONT_INVIS /<(?!style)[a-z]+\s[^>]{1,80}(?:font(?:-size)?\s*:\s*(?:0*[01](?:\.\d+)?(?:px|pt|Q|vw|vh|vmin)|0+(?:\.\d+)?(?:cm|mm|in|pc|em|ex|ch|rem|lh|vmax))\s*[;'a-z]|color\s*:\s*transparent\s*[;'])[^>]{0,80}>\w/i
tflags __FONT_INVIS multiple maxhits=6
meta __FONT_INVIS_MANY __FONT_INVIS > 5
- meta HTML_TEXT_INVISIBLE_FONT __FONT_INVIS_MANY && !__HAS_ERRORS_TO && !__URI_DOTGOV && !__L_CTE_7BIT
+ meta HTML_TEXT_INVISIBLE_FONT __FONT_INVIS_MANY && !__HAS_ERRORS_TO && !__URI_DOTGOV && !__L_CTE_7BIT && !__LYRIS_EZLM_REMAILER
describe HTML_TEXT_INVISIBLE_FONT HTML hidden text - word obfuscation?
score HTML_TEXT_INVISIBLE_FONT 3.000 # limit
tflags HTML_TEXT_INVISIBLE_FONT publish
+
+ # Does this hit less ham while still hitting spam?
+ rawbody __WORD_INVIS /<(?!style)[a-z]+\s[^>]{1,80}(?:font(?:-size)?\s*:\s*(?:0*[01](?:\.\d+)?(?:px|pt|Q|vw|vh|vmin)|0+(?:\.\d+)?(?:cm|mm|in|pc|em|ex|ch|rem|lh|vmax))\s*[;'a-z]|color\s*:\s*transparent\s*[;'])[^>]{0,80}>\w{1,20}</i
+ tflags __WORD_INVIS multiple maxhits=6
+ meta __WORD_INVIS_MANY __WORD_INVIS > 5
+
+ meta __FONT_INVIS_LONG_LINE __FONT_INVIS && __LONGLINE
+ meta __FONT_INVIS_NORDNS __FONT_INVIS && __RDNS_NONE
+
endif
# Adapted from SARE rules __SARE_HTML_SINGLET*