[Fix] Fix an edge case in BITCOIN_ADDR rule

 - when using PCRE
 - and different address types are present

diff --git a/rules/bitcoin.lua b/rules/bitcoin.lua
index 56969536c2a65616d046c78a58d0d6455d90dcf1..3cf97fcbee022f560e1d6027c443d02ec1f570a6 100644 (file)
--- a/rules/bitcoin.lua
+++ b/rules/bitcoin.lua
@@ -180,7 +180,8 @@ local btc_bleach_re = [[/\b(?:(?:[a-zA-Z]\w+:)|(?:bc1))?[qpzry9x8gf2tvdw0s3jn54k
 
 config.regexp['BITCOIN_ADDR'] = {
   description = 'Message has a valid bitcoin wallet address',
-  re = string.format('(%s) || (%s)', normal_wallet_re, btc_bleach_re),
+  -- Use + operator to ensure that each expression is always evaluated
+  re = string.format('(%s) + (%s) > 0', normal_wallet_re, btc_bleach_re),
   re_conditions = {
     [normal_wallet_re] = function(task, txt, s, e)
       if e - s <= 2 then
@@ -228,4 +229,4 @@ config.regexp['BITCOIN_ADDR'] = {
   score = 0.0,
   one_shot = true,
   group = 'scams',
-}
\ No newline at end of file
+}

diff --git a/test/functional/cases/001_merged/280_rules.robot b/test/functional/cases/001_merged/280_rules.robot
index 52ea1c86dd83c2533cdc89231ccfc1fd144892c0..2ae2f7422f873f31ed4961e260dd8e092da72545 100644 (file)
--- a/test/functional/cases/001_merged/280_rules.robot
+++ b/test/functional/cases/001_merged/280_rules.robot
@@ -66,6 +66,12 @@ BITCOIN ADDR 3
   ...  Settings={symbols_enabled = [BITCOIN_ADDR]}
   Expect Symbol  BITCOIN_ADDR
 
+BITCOIN ADDR 4
+  Scan File  ${RSPAMD_TESTDIR}/messages/btc4.eml
+  ...  Settings={symbols_enabled = [BITCOIN_ADDR]}
+  Expect Symbol With Exact Options  BITCOIN_ADDR  1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2
+  ...  bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq  bitcoincash:qztslqhavnjcgth9zwu6dw0jjcfy4zahfy7vf0smwp
+
 RCVD_COUNT_ONE
   Scan File  ${RSPAMD_TESTDIR}/messages/btc.eml
   ...  Settings={symbols_enabled = [RCVD_COUNT_ONE]}

diff --git a/test/functional/messages/btc4.eml b/test/functional/messages/btc4.eml
new file mode 100644 (file)
index 0000000..523ce59
--- /dev/null
+++ b/test/functional/messages/btc4.eml
@@ -0,0 +1,26 @@
+Received: by mail-lf1-f54.gulugulu.com with SMTP id j14so14439709lfg.9
+        for <test@test.ru>; Mon, 27 Apr 2020 09:54:21 -0700 (PDT)
+From: test@test.com
+Date: Mon, 27 Apr 2020 19:54:10 +0300
+Message-ID: <CA+1S=h4aGimA6vSBJF=t1F+5z-Mua5+Cimf+NU_NDWJk8ZNOcw@mail.gmail.com>
+Subject: Fwd:
+To: <test@test.ru>
+Content-Type: multipart/alternative; boundary="00000000000004de7805a4489190"
+
+--0000000000004bee6805a4484c02
+Content-Type: text/plain; charset="UTF-8"
+Content-Transfer-Encoding: 8bit
+
+bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq
+bitcoincash:qztslqhavnjcgth9zwu6dw0jjcfy4zahfy7vf0smwp
+1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2
+
+--0000000000004bee6805a4484c02
+Content-Type: text/html; charset="UTF-8"
+Content-Transfer-Encoding: 8bit
+
+bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq
+bitcoincash:qztslqhavnjcgth9zwu6dw0jjcfy4zahfy7vf0smwp
+1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2
+
+--0000000000004bee6805a4484c02--