diff options
| author | Vsevolod Stakhov <vsevolod@rspamd.com> | 2023-02-19 23:20:56 +0000 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-02-19 23:20:56 +0000 |
| commit | 1e27c46e5d929f660810e60505db059c2c81b79d (patch) | |
| tree | c482f282a247023a71f05160ae557f1c5f3c5d81 /rules | |
| parent | 00896ca733b6098f45f6f3cfb4edcc77ff9bb786 (diff) | |
| parent | 5684ffe1779ab4f8675cd13e969ab2357509a8e3 (diff) | |
| download | rspamd-1e27c46e5d929f660810e60505db059c2c81b79d.tar.gz rspamd-1e27c46e5d929f660810e60505db059c2c81b79d.zip | |
Merge branch 'master' into temp-propose-alternative-solution-to-xbl-any-hack
Diffstat (limited to 'rules')
| -rw-r--r-- | rules/content.lua | 2 | ||||
| -rw-r--r-- | rules/forwarding.lua | 1 | ||||
| -rw-r--r-- | rules/mid.lua | 1 | ||||
| -rw-r--r-- | rules/regexp/compromised_hosts.lua | 1 | ||||
| -rw-r--r-- | rules/regexp/headers.lua | 15 | ||||
| -rw-r--r-- | rules/regexp/misc.lua | 2 | ||||
| -rw-r--r-- | rules/subject_checks.lua | 2 |
7 files changed, 14 insertions, 10 deletions
diff --git a/rules/content.lua b/rules/content.lua index 038d4f63a..0936f5898 100644 --- a/rules/content.lua +++ b/rules/content.lua @@ -113,4 +113,4 @@ rspamd_config:register_symbol{ name = 'PDF_TIMEOUT', parent = id, groups = {"content", "pdf"}, -}
\ No newline at end of file +} diff --git a/rules/forwarding.lua b/rules/forwarding.lua index f88c767ab..7d79a0c31 100644 --- a/rules/forwarding.lua +++ b/rules/forwarding.lua @@ -153,4 +153,3 @@ rspamd_config.FORWARDED = { description = "Message was forwarded", group = "forwarding" } - diff --git a/rules/mid.lua b/rules/mid.lua index 2076debb0..14c701cf6 100644 --- a/rules/mid.lua +++ b/rules/mid.lua @@ -125,4 +125,3 @@ rspamd_config:register_symbol { end end } - diff --git a/rules/regexp/compromised_hosts.lua b/rules/regexp/compromised_hosts.lua index 0a9a9f0aa..cfd560bc2 100644 --- a/rules/regexp/compromised_hosts.lua +++ b/rules/regexp/compromised_hosts.lua @@ -211,4 +211,3 @@ reconf['WWW_DOT_DOMAIN'] = { score = 0.5, group = "compromised_hosts" } - diff --git a/rules/regexp/headers.lua b/rules/regexp/headers.lua index e493a663e..a2b95c2c7 100644 --- a/rules/regexp/headers.lua +++ b/rules/regexp/headers.lua @@ -439,7 +439,7 @@ reconf['FORGED_MUA_OPERA_MSGID'] = { -- Detect forged Mozilla Mail/Thunderbird/Seamonkey/Postbox headers -- Mozilla based X-Mailer local user_agent_mozilla5 = 'User-Agent=/^\\s*Mozilla\\/5\\.0/H' -local user_agent_thunderbird = 'User-Agent=/^\\s*(Thunderbird|Mozilla Thunderbird|Mozilla\\/.*Gecko\\/.*(Thunderbird|Icedove)\\/)/H' +local user_agent_thunderbird = 'User-Agent=/^\\s*(Thunderbird|Mozilla Thunderbird|Mozilla\\/.*Gecko\\/.*(Thunderbird|Betterbird|Icedove)\\/)/H' local user_agent_seamonkey = 'User-Agent=/^\\s*Mozilla\\/5\\.0\\s.+\\sSeaMonkey\\/\\d+\\.\\d+/H' local user_agent_postbox = [[User-Agent=/^\s*Mozilla\/5\.0\s\([^)]+\)\sGecko\/\d+\sPostboxApp\/\d+(?:\.\d+){2,3}$/H]] local user_agent_mozilla = string.format('(%s) & !(%s) & !(%s) & !(%s)', user_agent_mozilla5, user_agent_thunderbird, user_agent_seamonkey, user_agent_postbox) @@ -908,14 +908,21 @@ reconf['HAS_LIST_UNSUB'] = { reconf['HAS_GUC_PROXY_URI'] = { re = '/\\.googleusercontent\\.com\\/proxy/{url}i', - description = 'Has googleusercontent.com proxy URI', - score = 0.01, - group = 'experimental' + description = 'Has googleusercontent.com proxy URL', + score = 1.0, + group = 'url' } reconf['HAS_GOOGLE_REDIR'] = { re = '/\\.google\\.com\\/url\\?/{url}i', description = 'Has google.com/url redirection', + score = 1.0, + group = 'url' +} + +reconf['HAS_GOOGLE_FIREBASE_URL'] = { + re = '/\\.firebasestorage\\.googleapis\\.com\\//{url}i', + description = 'Contains firebasestorage.googleapis.com URL', score = 0.01, group = 'experimental' } diff --git a/rules/regexp/misc.lua b/rules/regexp/misc.lua index a5e5cfc44..0e660e358 100644 --- a/rules/regexp/misc.lua +++ b/rules/regexp/misc.lua @@ -99,4 +99,4 @@ reconf['LEAKED_PASSWORD_SCAM_RE'] = { group = 'scams' } -rspamd_config:register_dependency('LEAKED_PASSWORD_SCAM', 'BITCOIN_ADDR')
\ No newline at end of file +rspamd_config:register_dependency('LEAKED_PASSWORD_SCAM', 'BITCOIN_ADDR') diff --git a/rules/subject_checks.lua b/rules/subject_checks.lua index d0a41d920..27f435729 100644 --- a/rules/subject_checks.lua +++ b/rules/subject_checks.lua @@ -67,4 +67,4 @@ rspamd_config.LONG_SUBJ = { group = 'subject', type = 'mime', description = 'Subject is too long' -}
\ No newline at end of file +} |