From 3f147877af03e70bac4cb9786108c2238d578038 Mon Sep 17 00:00:00 2001 From: Vsevolod Stakhov Date: Fri, 30 Nov 2018 10:00:21 +0000 Subject: [Rules] Use bad_unicode flag for LEAKED_PASSWORD_SCAM rule Issue: #2649 --- rules/regexp/misc.lua | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'rules') diff --git a/rules/regexp/misc.lua b/rules/regexp/misc.lua index 2332cd6ce..3a78ec969 100644 --- a/rules/regexp/misc.lua +++ b/rules/regexp/misc.lua @@ -61,14 +61,14 @@ reconf['HAS_ONION_URI'] = { group = 'experimental' } -local password_in_subject = [[Subject=/\bpassword\b/i]] -local password_in_body = [[/\bpassword\b/i{sa_body}]] +local password_in_words = [[/^password/i{words}]] local btc_wallet_address = [[/^[13][0-9a-zA-Z]{25,34}$/{words}]] local wallet_word = [[/^wallet$/i{words}]] +local broken_unicode = [[has_flag(bad_unicode)]] reconf['LEAKED_PASSWORD_SCAM'] = { - re = string.format('(%s | %s) & %s & %s', password_in_subject, - password_in_body, btc_wallet_address, wallet_word), + re = string.format('%s & %s & (%s | %s)', + password_in_words, btc_wallet_address, wallet_word, broken_unicode), description = 'Contains password word and BTC wallet address', score = 7.0, group = 'scams' -- cgit v1.2.3