On Wed, 2004-02-18 at 15:48, David Muir Sharnoff wrote:
> As for URI's, I think it would be a mistake to include <img src=> 
> URIs as many of those point to innocent bystanders.

But if they are innocent bystanders you wouldn't have URI rules against
them anyway, would you?

> URIs should be HTML decoded.  I've run into a number of spammers who
> write things like:
> 
>       h&#116;&#0x00054;p://

This is a good idea. So if you wanted to match an encoded URI, you would
match on Full, otherwise, you could match against URI.

> In terms of naming, "full" and "rawbody" don't have predictable meanings
> without reading the documentation.  (With 2.63 even with the documentation
> they aren't predictable).
> 
> I suggest that "full" and "rawbody" be deprecated in favor of:
> "alltext" and "raw" or "rawmessage".  In case it's not obvious, "alltext"
> would replace "rawbody" and "raw" would replace "full".

I agree. I was going to suggest some sort of naming change to have the parts be 
more descriptive, but then you would have to worry about ruleset 
backward-compatibility. I suppose that's not a big deal, if SA were to treat 
both the old and new names as the same. Maybe this would be a good change for 
3.0?
I would suggest something like:

Full -> Raw (as this really is the 'raw' message)
Rawbody -> Decoded or RawDecoded (if this were just like the 'raw' message, but 
with decoded parts)
Body -> Text (just to make it more explicit that this is the text from the 
message)



Reply via email to