From 5c669479a0e0630f822929714332b615f11210a6 Mon Sep 17 00:00:00 2001
From: Steve Freegard <steve@stevefreegard.com>
Date: Mon, 21 Nov 2016 12:55:14 +0000
Subject: Rules updates

---
 rules/regexp/misc.lua | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 rules/regexp/misc.lua

(limited to 'rules/regexp/misc.lua')

diff --git a/rules/regexp/misc.lua b/rules/regexp/misc.lua
new file mode 100644
index 000000000..a819ec729
--- /dev/null
+++ b/rules/regexp/misc.lua
@@ -0,0 +1,39 @@
+--[[
+Copyright (c) 2011-2016, Vsevolod Stakhov <vsevolod@highsecure.ru>
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+]]--
+
+
+local reconf = config['regexp']
+
+reconf['HTML_META_REFRESH_URL'] = {
+  -- Requires options { check_attachements = true; }
+  re = '/<meta\\s+http-equiv="refresh"\\s+content="\\d+;url=/{sa_raw_body}i',
+  description = "Has HTML Meta refresh URL",
+  score = 5.0
+}
+
+reconf['HAS_DATA_URI'] = {
+  -- Requires options { check_attachements = true; }
+  re = '/data:[^\\/]+\\/[^; ]+;base64,/{sa_raw_body}i',
+  description = "Has Data URI encoding"
+}
+
+reconf['DATA_URI_OBFU'] = {
+  -- Requires options { check_attachements = true; }
+  re = '/data:text\\/(?:plain|html);base64,/{sa_raw_body}i',
+  description = "Uses Data URI encoding to obfuscate plain or HTML in base64",
+  score = 2.0
+}
+
-- 
cgit v1.2.3