I managed to write a metarule for anyone interested, to catch a URL with
trailing : without a port specified, without FP on a 4 digit port.
uri __SpoofPort_URL /.*\:.*|.*\...:.*/
uri __OkPort_URL
/.*\:[0-9]|.*\:[0-9].+\/.*|.*\...:[0-9]|.*\...:[0-9].+\/.*/
meta Spoof_Port_URL
On Sat, Mar 05, 2005 at 11:07:22AM +0100, Raymond Dijkxhoorn wrote:
> Any ETA on 3.1 ?
Nothing official. We're planning a bug fix fest (or whatever you want to call
it) later this coming week, and we'll have to figure out what is left for 3.1
versus what can get punted to 3.2. There's also the w
Duncan,
As written your rule only checks for a ':' immediately before a '/'.
But at least one valid use of the colon is http://[EMAIL PROTECTED]:host, which
is defined as part of the stardard HTTP protocol.
Paul Shupak
[EMAIL PROTECTED]
|-Original Message-
|From: Duncan Hill [mailto:[EMAIL PROTECTED]
|Sent: 05 March 2005 15:02
|To: users@spamassassin.apache.org
|Subject: Re: [SPAM-TAG] SURBL missing this spam
|
|On Saturday 05 March 2005 14:49, martin smith wrote:
|> |uri SpoofPort_URL /.*\:.*|.*\...:.*/ sc
On Saturday 05 March 2005 14:49, martin smith wrote:
> |uri SpoofPort_URL /.*\:.*|.*\...:.*/ score SpoofPort_URL 1
>
> Ok MK2 that one could FP on genuine URLs with a port specified
>
> uri SpoofPort_URL /.*\:.*|.*\...:.*/
> score SpoofPort_URL 1
> uri OkPort_URL
> /.*\:|.*\...:
|
|uri SpoofPort_URL /.*\:.*|.*\...:.*/ score SpoofPort_URL 1
|
Ok MK2 that one could FP on genuine URLs with a port specified
uri SpoofPort_URL /.*\:.*|.*\...:.*/
score SpoofPort_URL 1
uri OkPort_URL
/.*\:|.*\...:./|/.*\:\/.*|.*\...:.\/.*/
score OkPort_URL -1
Sorr
|-Original Message-
|From: martin smith [mailto:[EMAIL PROTECTED]
|Sent: 05 March 2005 11:41
|To: Spamassassin
|Subject: RE: [SPAM-TAG] SURBL missing this spam
|
|Is there a uri rule we could use to catch e.g. .com: or .uk:
|in the mean time untill 3.1 becomes available, there is a
|-Original Message-
|From: Theo Van Dinter [mailto:[EMAIL PROTECTED]
|Sent: 05 March 2005 01:27
|To: SpamAssassin Users
|Subject: Re: [SPAM-TAG] SURBL missing this spam
|
|On Fri, Mar 04, 2005 at 05:23:35PM -0800, Jeff Chan wrote:
|> Given that it's apparently fixed in 3.1 should
On Saturday, March 5, 2005, 2:07:22 AM, Raymond Dijkxhoorn wrote:
>>> http://crazyrxl0wprices-MUNGED.com:/
>>>
>>> Maybe that syntax is throwing off SA?
>> Yeah, it does look like a bug somewhere in 3.0.x. 3.1 catches it fine,
>> fwiw.
>>
>> 3.0:
>> debug: URIDNSBL: domains to query:
>>
>> 3.1
Hi Theo,
http://crazyrxl0wprices-MUNGED.com:/
Maybe that syntax is throwing off SA?
Yeah, it does look like a bug somewhere in 3.0.x. 3.1 catches it fine,
fwiw.
3.0:
debug: URIDNSBL: domains to query:
3.1:
debug: uridnsbl: domains to query: crazyrxl0wprices.com
Any ETA on 3.1 ?
Thanks,
Raymond.
On Friday, March 4, 2005, 7:37:45 PM, David Funk wrote:
> On Fri, 4 Mar 2005, Jeff Chan wrote:
>> On Friday, March 4, 2005, 5:12:28 PM, Theo Dinter wrote:
>> > On Fri, Mar 04, 2005 at 05:10:42PM -0800, Jeff Chan wrote:
>> >> The URI is a little unusual, with a missing port number after the
>> >> c
On Fri, 4 Mar 2005, Jeff Chan wrote:
> On Friday, March 4, 2005, 5:12:28 PM, Theo Dinter wrote:
> > On Fri, Mar 04, 2005 at 05:10:42PM -0800, Jeff Chan wrote:
> >> The URI is a little unusual, with a missing port number after the
> >> colon:
> >>
> >> http://crazyrxl0wprices-MUNGED.com:/
> >>
>
On Fri, Mar 04, 2005 at 05:23:35PM -0800, Jeff Chan wrote:
> Given that it's apparently fixed in 3.1 should we make a
> bugzilla? Might it be worth reviewing that the expression or
> code was specifically fixed to explain this (better) behavior?
> Or would that be unnecessary?
I wouldn't bother w
On Friday, March 4, 2005, 5:12:28 PM, Theo Dinter wrote:
> On Fri, Mar 04, 2005 at 05:10:42PM -0800, Jeff Chan wrote:
>> The URI is a little unusual, with a missing port number after the
>> colon:
>>
>> http://crazyrxl0wprices-MUNGED.com:/
>>
>> Maybe that syntax is throwing off SA?
> Yeah, it
- Original Message -
From: "Jeff Chan" <[EMAIL PROTECTED]>
> On Friday, March 4, 2005, 3:47:04 PM, martin smith wrote:
> > I must have received this spam 12 times or more in the last 24 hours and
> > even though its listed on the SURBL, spamassassin fails to match it
against
> > them.
> >
On Sat, Mar 05, 2005 at 01:12:54AM +, Matthew Newton wrote:
> On Fri, Mar 04, 2005 at 05:10:42PM -0800, Jeff Chan wrote:
> > The URI is a little unusual, with a missing port number after the
> > colon:
> >
> > http://crazyrxl0wprices-MUNGED.com:/
>
> I can confirm that behaviour here.
>
>
On Fri, Mar 04, 2005 at 05:10:42PM -0800, Jeff Chan wrote:
> The URI is a little unusual, with a missing port number after the
> colon:
>
> http://crazyrxl0wprices-MUNGED.com:/
I can confirm that behaviour here.
http://blocked-domain.com/ is picked up
http://blocked-domain.com:/ i
On Fri, Mar 04, 2005 at 05:10:42PM -0800, Jeff Chan wrote:
> The URI is a little unusual, with a missing port number after the
> colon:
>
> http://crazyrxl0wprices-MUNGED.com:/
>
> Maybe that syntax is throwing off SA?
Yeah, it does look like a bug somewhere in 3.0.x. 3.1 catches it fine,
fwi
On Friday, March 4, 2005, 3:47:04 PM, martin smith wrote:
> I must have received this spam 12 times or more in the last 24 hours and
> even though its listed on the SURBL, spamassassin fails to match it against
> them.
> When I submit the spams to spamcop it parses the url everytime.
> SURBL seems
19 matches
Mail list logo
