From: Anton Yuzhaninov <citrin+git@citrin.ru>
Date: Thu, 5 Aug 2021 14:54:20 +0000 (+0100)
Subject: [Rules] Micro-optimize X_PHP_EVAL
X-Git-Tag: 3.0~47^2
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=refs%2Fpull%2F3838%2Fhead;p=rspamd.git

[Rules] Micro-optimize X_PHP_EVAL

Remove /i flag from regexp string "eval()'d code" is always in
lower case. While here use long string format for readability.
---

diff --git a/rules/regexp/compromised_hosts.lua b/rules/regexp/compromised_hosts.lua
index 97d80853e..0a9a9f0aa 100644
--- a/rules/regexp/compromised_hosts.lua
+++ b/rules/regexp/compromised_hosts.lua
@@ -92,7 +92,7 @@ reconf['HAS_X_ANTIABUSE'] = {
 }
 
 reconf['X_PHP_EVAL'] = {
-  re = "X-PHP-Script=/eval\\(\\)\\'d/Hi || X-PHP-Originating-Script=/eval\\(\\)\\'d/Hi",
+  re = [[X-PHP-Script=/eval\(\)'d code/H || X-PHP-Originating-Script=/eval\(\)'d code/H]],
   description = "Message sent using eval'd PHP",
   score = 4.0,
   group = "compromised_hosts"