On Monday 12 January 2004 03:39 pm, Larry Starr wrote:
> Just noticed a message with an encoded URL, that misses, the "BIZ_TLD"
> rule, etc.
>
> The message body contains:
> <a href=3d"http://gf=2eclearmath=2ebiz/jsimp/index=2ehtml";><font
> face=3d"arial">scored </font>this way=2e
> <br><img src=3d"http://K=2eclearmath=2ebiz/images/js02=2ejpg"; border=3d=
> "0">
> </a>
>
> I know this wraps a bit ugly, when pasted into my mailer but, as you can
> see, the punctuation, in the URI, is all hex encoded. "=2e", instead of
> ".".
>
> I have a local rule, in the form of bigevil.cf, with the following
> sub-expression, that catches the above, but there has got to be a simpler
> way to do this.
>
> uri uri MyEvilList_001 ( /\b(?:=2e){0,1}clearmath(?:\.|=2e)biz)\b\i
>
> Does anyone know of a ruleset that handles this sort of thing, perhaps code
> that decodes the "=xx" expressions prior to the "URI" matches?
Looking closer, at the offending messages, I have devised the following rule,
intended to identify URI's that contain no dot(s).
uri FCS_URI_NODOTS /^[^\.]*$/
describe FCS_URI_NODOTS URI found with no Dots (.)
score FCS_URI_NODOTS 3.0
I believe that any "Valid" URI will contain, at least, one dot (".").
Thank you,
--
Larry G. Starr - [EMAIL PROTECTED] or [EMAIL PROTECTED]
Software Engineer: Full Compass Systems LTD.
Phone: 608-831-7330 x 1347 FAX: 608-831-6330
===================================================================
There are only three sports: bullfighting, mountaineering and motor
racing, all the rest are merely games! - Ernest Hemmingway
-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
