Mailing List Archive

svn commit: rev 6509 - in incubator/spamassassin/trunk: lib/Mail/SpamAssassin rules
Author: quinlan
Date: Wed Feb 4 23:34:27 2004
New Revision: 6509

Modified:
incubator/spamassassin/trunk/lib/Mail/SpamAssassin/HTML.pm
incubator/spamassassin/trunk/rules/20_html_tests.cf
incubator/spamassassin/trunk/rules/70_cvs_rules_under_test.cf
Log:
promote HTML_CONVERTED
add a new test rule (not usable yet)


Modified: incubator/spamassassin/trunk/lib/Mail/SpamAssassin/HTML.pm
==============================================================================
--- incubator/spamassassin/trunk/lib/Mail/SpamAssassin/HTML.pm (original)
+++ incubator/spamassassin/trunk/lib/Mail/SpamAssassin/HTML.pm Wed Feb 4 23:34:27 2004
@@ -713,7 +713,7 @@
if ($self->{html_last_tag} eq "div" &&
$text =~ /Converted from text\/plain format/)
{
- $self->{html}{t_html_converted} = 1;
+ $self->{html}{div_converted} = 1;
}
if (exists $self->{html}{"inside_script"} && $self->{html}{"inside_script"} > 0)
{

Modified: incubator/spamassassin/trunk/rules/20_html_tests.cf
==============================================================================
--- incubator/spamassassin/trunk/rules/20_html_tests.cf (original)
+++ incubator/spamassassin/trunk/rules/20_html_tests.cf Wed Feb 4 23:34:27 2004
@@ -91,6 +91,10 @@
body HTML_COMMENT_SAVED_URL eval:html_eval('comment_text', '=~ /<!-- saved from url=\(\d{4}\)/')
describe HTML_COMMENT_SAVED_URL HTML message is a saved web page

+# Comment is a spam sign when following <DIV>
+body HTML_CONVERTED eval:html_test('div_converted')
+describe HTML_CONVERTED HTML conversion tool used by spam
+
body HTML_EMBEDS eval:html_test('embeds')
describe HTML_EMBEDS HTML with embedded plugin object


Modified: incubator/spamassassin/trunk/rules/70_cvs_rules_under_test.cf
==============================================================================
--- incubator/spamassassin/trunk/rules/70_cvs_rules_under_test.cf (original)
+++ incubator/spamassassin/trunk/rules/70_cvs_rules_under_test.cf Wed Feb 4 23:34:27 2004
@@ -389,7 +389,6 @@
# 29.483 69.2323 0.0285 1.000 1.00 0.01 T_MPART_ALT_DIFF_95
# 29.771 69.8892 0.0421 0.999 1.00 0.01 T_MPART_ALT_DIFF_90
#
-#
body T_MPART_ALT_DIFF_90 eval:multipart_alternative_difference('90', '100')
body T_MPART_ALT_DIFF_95 eval:multipart_alternative_difference('95', '100')
body T_MPART_ALT_DIFF_96 eval:multipart_alternative_difference('96', '100')
@@ -454,13 +453,6 @@
header T_MSGID_SPAM_2_B MESSAGEID =~ /<[A-Z]{7}-000[0-9]{10}\@[a-z]*>/
describe T_MSGID_SPAM_2_B Message-ID has known spammer pattern

-# Comment is a spam sign when following <DIV>
-rawbody T_HTML_CONVERTED m{<DIV><!-- Converted from text/plain format -->}
-describe T_HTML_CONVERTED HTML conversion tool used by spam
-
-body T_HTML_CONVERTED_2 eval:html_test('t_html_converted')
-describe T_HTML_CONVERTED_2 HTML conversion tool used by spam
-
# another Message-Id format (pick one as MSGID_SPAM_3)
header T_MSGID_SPAM_3_5 Message-Id =~ /<[a-z]{5,}\@(\S+\.)+\S+>/
describe T_MSGID_SPAM_3_5 Message-ID has known spammer pattern
@@ -469,3 +461,14 @@
header T_MSGID_SPAM_3_7 Message-Id =~ /<[a-z]{7,}\@(\S+\.)+\S+>/
describe T_MSGID_SPAM_3_7 Message-ID has known spammer pattern

+# evil spam tool
+# Message-ID generator algorithm:
+# letter: 1/2 (pick a-z) | 1/2 (pick 0-9)
+# 10-29 letters: 1/8 (pick $) | 1/8 (pick -) | 3/8 (pick a-z) | 3/8 (pick 0-9)
+# letter: 1/2 (pick a-z) | 1/2 (pick 0-9)
+# @
+# letter: 2/3 (pick a-z) | 1/3 (pick 0-9)
+# 3-12 letters: 1/8 (pick .) | 7/12 (pick a-z) | 7/24 (pick 0-9)
+# letter: 2/3 (pick a-z) | 1/3 (pick 0-9)
+header T_MSGID_EVIL_SPAM_1 MESSAGEID =~ /<[a-z\d][a-z\d\$-]+[a-z\d]\@[a-z\d][a-z\d.]+[a-z\d]>/
+header T_MSGID_EVIL_SPAM_2 MESSAGEID =~ /<[a-z\d][a-z\d\$-]{10,29}[a-z\d]\@[a-z\d][a-z\d.]{3,12}[a-z\d]>/