On 19-Mar-2009, at 15:18, James Wilkinson wrote:
John Hardin wrote:
No reason it shouldn't be. I'd suggest something like a rawbody match on /<object[\s>]/i meta'd with HTML_MESSAGE should be worth a few (dozen)
points.

This would seem to FP on Microsoft HTML generated by certain versions of
Word. One example:

  </xml><![endif]–><!–[if gte mso 9]><xml>
<w:LatentStyles DefLockedState=3D”false” LatentStyleCount=3D”156”>
   </w:LatentStyles>
  </xml><![endif]–><!–[if !mso]><object
   classid=3D”clsid:99999999-CA0E-42D2-AAAA-AAAAAAAAAAAA”
  id=3Dieooui></objec=
  t>
  <style>

James.

Well, _I_ would not consider MSFT Word generated HTML a "false" positive... :)

Bet then I suppose you could look at something like

<object[^>]*http:.*>


--
A man, in a word, who should never have been taught to write and
        whom if unhappily gifted with that ability, should have been
        restrained by a Act of Parliament from writing Reminiscences.
        - PG Wodehouse

Reply via email to