diff options
| author | Anton Yuzhaninov <citrin+git@citrin.ru> | 2021-08-05 15:54:20 +0100 |
|---|---|---|
| committer | Anton Yuzhaninov <citrin+git@citrin.ru> | 2021-08-05 15:54:20 +0100 |
| commit | 0248bd6615e29e8b4b910cfe854a73b6f3462499 (patch) | |
| tree | 17ae00482c97a910ccc4bb5110da7f2006c5784d /rules/regexp | |
| parent | 3789d5c1d38223a98c4fda0c3b987b88aa5849b8 (diff) | |
| download | rspamd-0248bd6615e29e8b4b910cfe854a73b6f3462499.tar.gz rspamd-0248bd6615e29e8b4b910cfe854a73b6f3462499.zip | |
[Rules] Micro-optimize X_PHP_EVAL
Remove /i flag from regexp string "eval()'d code" is always in
lower case. While here use long string format for readability.
Diffstat (limited to 'rules/regexp')
| -rw-r--r-- | rules/regexp/compromised_hosts.lua | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/rules/regexp/compromised_hosts.lua b/rules/regexp/compromised_hosts.lua index 97d80853e..0a9a9f0aa 100644 --- a/rules/regexp/compromised_hosts.lua +++ b/rules/regexp/compromised_hosts.lua @@ -92,7 +92,7 @@ reconf['HAS_X_ANTIABUSE'] = { } reconf['X_PHP_EVAL'] = { - re = "X-PHP-Script=/eval\\(\\)\\'d/Hi || X-PHP-Originating-Script=/eval\\(\\)\\'d/Hi", + re = [[X-PHP-Script=/eval\(\)'d code/H || X-PHP-Originating-Script=/eval\(\)'d code/H]], description = "Message sent using eval'd PHP", score = 4.0, group = "compromised_hosts" |