From 84384ae4e65ff85b0feedd00ec27506dd5b9dbc7 Mon Sep 17 00:00:00 2001
From: Vsevolod Stakhov <vsevolod@highsecure.ru>
Date: Thu, 19 Sep 2019 12:13:48 +0100
Subject: [PATCH] [Conf] Make LEAKED_PASSWORD_SCAM a composite rule again

---
 conf/composites.conf  |  8 +++++++-
 rules/regexp/misc.lua | 14 ++++++--------
 2 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/conf/composites.conf b/conf/composites.conf
index 37b1c3da9..2204f1e71 100644
--- a/conf/composites.conf
+++ b/conf/composites.conf
@@ -148,7 +148,13 @@ composites {
     score = 0.0;
     policy = "remove_weight";
   }
-
+  LEAKED_PASSWORD_SCAM {
+    description = "Contains BTC wallet address and scam patterns";
+    expression = "BITCOIN_ADDR & (LEAKED_PASSWORD_SCAM_RE | R_MIXED_CHARSET | R_EMPTY_IMAGE)";
+    policy = "leave";
+    score = 7.0;
+    group = "scams";
+  }
 
   .include(try=true; priority=1; duplicate=merge) "$LOCAL_CONFDIR/local.d/composites.conf"
   .include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/composites.conf"
diff --git a/rules/regexp/misc.lua b/rules/regexp/misc.lua
index 98380d97f..2e497f877 100644
--- a/rules/regexp/misc.lua
+++ b/rules/regexp/misc.lua
@@ -66,19 +66,18 @@ local your_webcam = [[/webcam/{words}]]
 local your_onan = [[/(?:mast[ur]{2}bati(?:on|ng)|onanism|solitary)/{words}]]
 local password_in_words = [[/^pass(?:(?:word)|(?:phrase))$/i{words}]]
 local btc_wallet_address = [[has_symbol(BITCOIN_ADDR)]]
-local mixed_charset = [[has_symbol(R_MIXED_CHARSET)]]
 local wallet_word = [[/^wallet$/{words}]]
 local broken_unicode = [[has_flag(bad_unicode)]]
 local list_unsub = [[header_exists(List-Unsubscribe)]]
 local x_php_origin = [[header_exists(X-PHP-Originating-Script)]]
 
-reconf['LEAKED_PASSWORD_SCAM'] = {
-  re = string.format('%s & (%s | %s | %s | %s | %s | %s | %s | %s | %s | %s)',
+reconf['LEAKED_PASSWORD_SCAM_RE'] = {
+  re = string.format('%s & (%s | %s | %s | %s | %s | %s | %s | %s | %s)',
       btc_wallet_address, password_in_words, wallet_word,
       my_victim, your_webcam, your_onan,
       broken_unicode, 'lua:check_data_images',
-      list_unsub, x_php_origin, mixed_charset),
-  description = 'Contains password word and BTC wallet address',
+      list_unsub, x_php_origin),
+  description = 'Contains BTC wallet address and malicious regexps',
   functions = {
     check_data_images = function(task)
       local tp = task:get_text_parts() or {}
@@ -96,9 +95,8 @@ reconf['LEAKED_PASSWORD_SCAM'] = {
       return false
     end
   },
-  score = 7.0,
+  score = 0.0,
   group = 'scams'
 }
 
-rspamd_config:register_dependency('LEAKED_PASSWORD_SCAM', 'BITCOIN_ADDR')
-rspamd_config:register_dependency('LEAKED_PASSWORD_SCAM', 'R_MIXED_CHARSET')
\ No newline at end of file
+rspamd_config:register_dependency('LEAKED_PASSWORD_SCAM', 'BITCOIN_ADDR')
\ No newline at end of file
-- 
2.39.5