Re: HTML link regex

2012-09-28 Thread Martin Gregorie
On Wed, 2012-09-26 at 12:48 +0200, Axb wrote: > On 09/26/2012 12:46 PM, Martin Gregorie wrote: > > On Wed, 2012-09-26 at 12:05 +0200, Axb wrote: > >> have you looked at the URIDetail plugin ? > >> > > I didn't know it existed until now, but it looks useful. It looks as if > > it can easily solve th

Re: HTML link regex

2012-09-28 Thread Alexandre Boyer
Great, thanks, will do that today. Alex, from osmose. Bow before me, for I am root. On 12-09-27 07:04 PM, dar...@chaosreigns.com wrote: > On 09/27, Alexandre Boyer wrote: >> I met you earlier on the IRC channel, remember? > Yup. > >> Anyway, I would be glad to submit my rules (corrected by Bowie

Re: HTML link regex

2012-09-27 Thread darxus
On 09/27, Alexandre Boyer wrote: > I met you earlier on the IRC channel, remember? Yup. > Anyway, I would be glad to submit my rules (corrected by Bowie Bailey). > I indeed asked how one could do that. Open a bug: https://issues.apache.org/SpamAssassin/ Include the rule(s) and request that the

Re: HTML link regex

2012-09-27 Thread Alexandre Boyer
Hi there Darxus ! I met you earlier on the IRC channel, remember? Anyway, I would be glad to submit my rules (corrected by Bowie Bailey). I indeed asked how one could do that. Should I start a sandbox? I'm familiar with some aspects of SA, but the "return to the project" lack to my personnal cul

Re: HTML link regex

2012-09-27 Thread darxus
On 09/25, John Hardin wrote: > This topic comes up regularly enough that it should be a FAQ. Yeah. I haven't read this thread enough to know if it's been said, but here's a previous thread on the subject: http://spamassassin.1065346.n5.nabble.com/antiphishing-td52027i20.html And the existing ru

Re: HTML link regex

2012-09-27 Thread Alexandre Boyer
Alex, from Nexus7. Boyaah! Le 27 sept. 2012 14:34, "Bowie Bailey" a écrit : > > > On 9/27/2012 1:48 PM, Alexandre Boyer wrote: >> >> Alex, from prypiat. >> Yes, I recycle. >> >> >> On 12-09-27 11:09 AM, Bowie Bailey wrote: >>> >>> On 9/27/2012 10:41 AM, Alexandre Boyer wrote: Hello all,

Re: HTML link regex

2012-09-27 Thread Bowie Bailey
On 9/27/2012 1:48 PM, Alexandre Boyer wrote: Alex, from prypiat. Yes, I recycle. On 12-09-27 11:09 AM, Bowie Bailey wrote: On 9/27/2012 10:41 AM, Alexandre Boyer wrote: Hello all, Here is a small ruleset that I'm working with. I added it to our local ruleset in prod: # BAD LINKS N-NG

Re: HTML link regex

2012-09-27 Thread Alexandre Boyer
Alex, from prypiat. Yes, I recycle. On 12-09-27 11:09 AM, Bowie Bailey wrote: > On 9/27/2012 10:41 AM, Alexandre Boyer wrote: >> Hello all, >> >> Here is a small ruleset that I'm working with. I added it to our >> local ruleset in prod: >> >> # BAD LINKS N-NG ;-) ; >> # Canada Post >>

Re: HTML link regex

2012-09-27 Thread Bowie Bailey
On 9/27/2012 10:41 AM, Alexandre Boyer wrote: Hello all, Here is a small ruleset that I'm working with. I added it to our local ruleset in prod: # BAD LINKS N-NG ;-) ; # Canada Post

Re: HTML link regex

2012-09-27 Thread Alexandre Boyer
Hello all, Here is a small ruleset that I'm working with. I added it to our local ruleset in prod: # BAD LINKS N-NG ;-)

Re: HTML link regex

2012-09-26 Thread Martin Gregorie
On Wed, 2012-09-26 at 17:42 +0200, Axb wrote: > On 09/26/2012 05:38 PM, Martin Gregorie wrote: > > > then realised that SA makes no guarantees about the order in which rules > > are executed other than metarules being executed after all the > > (sub)rules they reference. Obviously this prevents th

Re: HTML link regex

2012-09-26 Thread Axb
On 09/26/2012 05:38 PM, Martin Gregorie wrote: then realised that SA makes no guarantees about the order in which rules are executed other than metarules being executed after all the (sub)rules they reference. Obviously this prevents the use of variables in rules. you could try and play with p

Re: HTML link regex

2012-09-26 Thread Martin Gregorie
On Wed, 2012-09-26 at 07:42 -0700, John Hardin wrote: > On Wed, 26 Sep 2012, Martin Gregorie wrote: > > > apart from the problem of matching the two halves if/when there is more > > than one URL in a message. > > I'm not following what you mean here, could you explain that in a bit more > detai

Re: HTML link regex

2012-09-26 Thread Alexandre Boyer
Alex, from prypiat. Yes, I recycle. On 12-09-26 11:03 AM, Bowie Bailey wrote: > On 9/26/2012 10:45 AM, Alexandre Boyer wrote: >> Hi all, >> >> Me happy :-D >> >> It works as expected for simple rules. >> >> For example, to get rid off my problem with youtube links I had this >> simple rule: >> >

Re: HTML link regex

2012-09-26 Thread Bowie Bailey
On 9/26/2012 10:45 AM, Alexandre Boyer wrote: Hi all, Me happy :-D It works as expected for simple rules. For example, to get rid off my problem with youtube links I had this simple rule: uri_detail Z_URIDETAIL_UTUBE_SPOOF raw !~ /youtube\./ text =~ /(https?://)?(www\.)?youtube\

Re: HTML link regex

2012-09-26 Thread Alexandre Boyer
Hi all, Me happy :-D It works as expected for simple rules. For example, to get rid off my problem with youtube links I had this simple rule: uri_detail Z_URIDETAIL_UTUBE_SPOOF raw !~ /youtube\./ text =~ /(https?://)?(www\.)?youtube\./ type =~ /^a$/ scoreZ_URIDETAIL_UTUB

Re: HTML link regex

2012-09-26 Thread John Hardin
On Wed, 26 Sep 2012, Martin Gregorie wrote: On Tue, 2012-09-25 at 22:12 -0700, John Hardin wrote: I'm thinking something like this, using what you presented as an example: Generated internal pseudo-header: X-Spam-URL: http://www.probono.fr/95280_pdf|http://www.youtube.com/watch?v=3VvOF

Re: HTML link regex

2012-09-26 Thread Alexandre Boyer
I found a couple of examples with uri_detail checks (instead of uri checks) that are written in a very similar way to what John suggested. I wil test this today. Having writen two plugins already (that is, on the edge to begin to understand how the PMS works ;) ), I knew that one could work with

Re: HTML link regex

2012-09-26 Thread Martin Gregorie
On Wed, 2012-09-26 at 12:48 +0200, Axb wrote: > On 09/26/2012 12:46 PM, Martin Gregorie wrote: > > On Wed, 2012-09-26 at 12:05 +0200, Axb wrote: > >> have you looked at the URIDetail plugin ? > >> > > I didn't know it existed until now, but it looks useful. It looks as if > > it can easily solve th

Re: HTML link regex

2012-09-26 Thread Axb
On 09/26/2012 12:46 PM, Martin Gregorie wrote: On Wed, 2012-09-26 at 12:05 +0200, Axb wrote: have you looked at the URIDetail plugin ? I didn't know it existed until now, but it looks useful. It looks as if it can easily solve the OP's problem too. Martin If you could create a couple of (w

Re: HTML link regex

2012-09-26 Thread Martin Gregorie
On Wed, 2012-09-26 at 12:05 +0200, Axb wrote: > have you looked at the URIDetail plugin ? > I didn't know it existed until now, but it looks useful. It looks as if it can easily solve the OP's problem too. Martin

Re: HTML link regex

2012-09-26 Thread Axb
On 09/26/2012 12:02 PM, Martin Gregorie wrote: On Tue, 2012-09-25 at 22:12 -0700, John Hardin wrote: I'm thinking something like this, using what you presented as an example: Generated internal pseudo-header: X-Spam-URL: http://www.probono.fr/95280_pdf|http://www.youtube.com/watch?v=3V

Re: HTML link regex

2012-09-26 Thread Martin Gregorie
On Tue, 2012-09-25 at 22:12 -0700, John Hardin wrote: > I'm thinking something like this, using what you presented as an example: > > Generated internal pseudo-header: > X-Spam-URL: > http://www.probono.fr/95280_pdf|http://www.youtube.com/watch?v=3VvOFqaHbL5&feature=g-vrec&feature=g-vrec >

Re: HTML link regex

2012-09-25 Thread John Hardin
Please keep the discussion on-list so others may benefit or make suggestions, thanks. On Tue, 25 Sep 2012, Alexandre Boyer wrote: I totaly agree. I think that the HTML parser could easily handle this. To the best of my knowledge, there is no modifier (like :addr or :name for From header ch

Re: HTML link regex

2012-09-25 Thread John Hardin
On Tue, 25 Sep 2012, Alexandre Boyer wrote: It's essentially FREEMAIL_FROM and the body only contains a fake Youtube link like: http://www.probono.fr/95280_pdf";>http://www.youtube.com/wa= tch?v=3D3VvOFqaHbL5&feature=3Dg-vrec&feature=3Dg-vrec This topic comes up regularly enough that it

HTML link regex

2012-09-25 Thread Alexandre Boyer
Hi list, I'm receiving a lot of spam of a very particular sort. It's essentially FREEMAIL_FROM and the body only contains a fake Youtube link like: http://www.probono.fr/95280_pdf";>http://www.youtube.com/wa= tch?v=3D3VvOFqaHbL5&feature=3Dg-vrec&feature=3Dg-vrec I ended with a regex fo