[Minor] Add rules that observes limits in pdf files

1 files changed, 25 insertions, 15 deletions

diff --git a/conf/scores.d/content_group.conf b/conf/scores.d/content_group.conf
index b53ec31d0..6a011b938 100644
--- a/conf/scores.d/content_group.conf
+++ b/conf/scores.d/content_group.conf
@@ -18,20 +18,30 @@
 description = "Content rules";
 
 symbols = {
-    "PDF_ENCRYPTED" {
-        weight = 0.3;
-        description = "There is an encrypted PDF in the message";
-        one_shot = true;
-    }
-    "PDF_JAVASCRIPT" {
-        weight = 0.1;
-        description = "There is an PDF with JavaScript in the message";
-        one_shot = true;
-    }
-    "PDF_SUSPICIOUS" {
-        weight = 4.5;
-        description = "There is an PDF with suspicious properties in the message";
-        one_shot = true;
-    }
+  "PDF_ENCRYPTED" {
+    weight = 0.3;
+    description = "There is an encrypted PDF in the message";
+    one_shot = true;
+  }
+  "PDF_JAVASCRIPT" {
+    weight = 0.1;
+    description = "There is an PDF with JavaScript in the message";
+    one_shot = true;
+  }
+  "PDF_SUSPICIOUS" {
+    weight = 4.5;
+    description = "There is an PDF with suspicious properties in the message";
+    one_shot = true;
+  }
+  "PDF_LONG_TRAILER" {
+    weight = 0.2;
+    description = "There is an PDF with a long trailer";
+    one_shot = true;
+  }
+  "PDF_MANY_OBJECTS" {
+    weight = 0;
+    description = "There is a PDF file with too many objects";
+    one_shot = true;
+  }
 }