On 22/08/11 20:37, Adam Katz wrote:
On 08/14/2011 02:17 PM, Ned Slider wrote:
Hi all,
The following email hits __HAS_ANY_URI and I'm not sure why:
http://pastebin.com/jvFrFhA4
When I run the message through SpamAssassin in debug mode I see:
dbg: rules: __DOS_HAS_ANY_URI merged duplicates: __HAS_ANY_URI
dbg: rules: ran uri rule __DOS_HAS_ANY_URI ======> got hit: "r"
SpamAssassin version 3.3.2
Any clues? I'm guessing it has something to do with the email address in
the message body?
The letter "r" is the beginning of an implicit mailto: URI in the body
(ram12...@live.com).
Thanks, you are right.
I didn't realise URI rules also matched email addresses but a simple
test confirms that any plain text email address in the message body
causes __HAS_ANY_URI to fire.
I guess that's just not what I had expected. Here's my revised version
that behaves more as I had expected:
uri __REALLY_HAS_ANY_URI m{https?://.}
and if we want to test for email addresses:
uri __HAS_ANY_URI_EMAIL /@/
and make __HAS_ANY_URI (and __DOS_HAS_ANY_URI) a meta of the above two
rules.
