Appreciate you adding this John,
I believe the adjusted rule is slightly off:
uri __PS_TEST_LOC_WP
m;/(?:wp-content/plugins|wp-content/themes|wp-includes|modules/mod_wdbanners|includes/|google_recommends|mt-static|data/module)/.{0,64}(?!\.gif|\.jpg|\.png|\.bmp).{4}$;i
should do with your adjustment
On 05/09/14 18:06, John Hardin wrote:
On Fri, 5 Sep 2014, Paul Stead wrote:
What would the thoughts on something like the following be?
uri LOC_WP
m{/((wp-content/plugins|wp-content/themes|wp-includes|modules/mod_wdbanners|includes/|google_recommends|mt-static|data/module).{0,64}(?!gif|jpg|png|bmp).{3})$}
This seems to match on the example posted, uses a negative match to not match
common image file types
I've added it to my sandbox with minor tweaks to give masscheck a chance to
evaluate it. Unfortunately if it does FP very much I can't provide examples of
what it FPs on for any message that's not in my corpora...
--
Paul Stead
Systems Engineer
Zen Internet
