On Tue, 4 Nov 2003, Charles Gregory wrote:
> On Tue, 4 Nov 2003, Colin A. Bartlett wrote:
> > I have a rule challenge for you all.
> > How can we write a rule to catch messages like the one attached?
>
> body LOC_BRMASK
> /<br>( ?|.){1,5}<br>( ?|.){1,5}<br>( ?|.){1,5}<br>/i
> describe LOC_BRMASK Masking BR tags with 1-5 characters between
> score LOC_BRMASK (see below)
>
> Initially, I'm scoring this one low, just to see what it hits, but I
> suspect that to be effective, this one test will have to score very *high*
> to compensate for the way this table/br technique successfully hides
> blacklist phrases/words.
Um, does the 'body' class work or do you need to use 'rawbody' to
"see" the unprocessed HTML?
The conf file man page makes it sound like the HTML tags are stripped
out before the 'body' rules are run.
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
-------------------------------------------------------
This SF.net email is sponsored by: SF.net Giveback Program.
Does SourceForge.net help you be more productive? Does it
help you create better code? SHARE THE LOVE, and help us help
YOU! Click Here: http://sourceforge.net/donate/
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
