On Tue, 23 Jun 2009, Jason Haar wrote:
They've already worked around these rules apparently. I just received
the following as part of an HTML-only email:
<P><FONT SIZE=3D2>blah blah www . ????28 . =
net<BR>
I've replaced "shop" with "????" - but you can see the line continuation
char to unwrap that "net" back onto the previous line.
Is there an existing SA function to "normalize" HTML content before
doing matches?
Yeah. body rules.
untested:
body OBFU_URI_WWDD_2
/\bwww\s(?:\W\s)?\w{3,6}\d{2,6}\s(?:\W\s)?(?:c\s?o\s?m|n\s?e\s?t|o\s?r\s?g)\b/i
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Microsoft is not a standards body.
-----------------------------------------------------------------------
12 days until the 233rd anniversary of the Declaration of Independence
