Hmz.... I'm having a lot of problems with a couple of rules that seem to
have completely broken after upgrading to spamassassin 3.0.
In 2.63 SARE_URI_EQUALS got 191 spam / 0 ham
Now the same masscheck yields: 10 results on the same corpus.
I just don't understand what's going on....
This is the rule in question:
uri SARE_URI_EQUALS
m{^(?:(?:h|%[46]8)(?:t|%[57]4){2}(?:p|%[57]0)(?:s|%[57]3)?(?::|%3a)?(?:%5c|\\|%2f|/){0,2})[^/\?;]+=(?!(?:..)?$).*}i
describe SARE_URI_EQUALS Trying to hide the real URL with IE
parsing bug
score SARE_URI_EQUALS 2.5
Any ideas why this is happening?
It probably has something to do with the "improved" way of parsing the
body for uri's, but somehow it isn't improving anything.
I'm seeing this with other rules aswell. For example the an
ILLEGAL_COLOR rule I've been working on always caugth up to 1700 hits in
my corpus, now I'm getting only 8. They're all valid and all, but it
isn't pleasing so to speak. I'd hate to have to set these rules to full
to see if they do better.... The Illegal color rule is darn ugly at the
moment, but here it is (should probably be converted to an eval test,
but this was quicker to see if it would work):
rawbody SARE_ILLEGAL_COLOR
/color\s{0,10}(?::|=(?:3d)?(?!3d))(?:[\s\'\"]){0,10}(?![\s\'\">])(?!$|"|\#?(?!\#)(?:[a-f0-9]{3}(?:\W|$)|[a-f0-9]{6}0?(?:\W|$))|rgb\(\s{0,10}(?:25[0-5]|2[0-4][0-9]|1?[0-9]?[0-9])\s{0,10},\s{0,10}(?:25[0-5]|2[0-4][0-9]|1?[0-9]?[0-9])\s{0,10},\s{0,10}(?:25[0-5]|2[0-4][0-9]|1?[0-9]?[0-9]\s{0,10})\)|rgb\(\s{0,10}1?[0-9]?[0-9]%\s{0,10},\s{0,10}1?[0-9]?[0-9]%\s{0,10},\s{0,10}1?[0-9]?[0-9]%\)|transparent|Black|White|Red|Yellow|Lime|Aqua|Blue|Fuchsia|Gr[ae]y|Silver|Maroon|Olive|Green|Teal|Navy|Purple|AliceBlue|AliceBlue|AntiqueWhite|Aqua|Aquamarine|Azure|Beige|Bisque|Black|BlanchedAlmond|Blue|BlueViolet|Brown|BurlyWood|CadetBlue|Chartreuse|Chocolate|Coral|CornflowerBlue|Cornsilk|Crimson|Cyan|DarkBlue|DarkCyan|DarkGoldenrod|DarkGr[ea]y|DarkGreen|DarkKhaki|DarkMagenta|DarkOliveGreen|DarkOrange|DarkOrchid|DarkRed|DarkSalmon|DarkSeaGreen|DarkSlateBlue|DarkSlateGray|DarkTurquoise|DarkViolet|DeepPink|DeepSkyBlue|DimGray|DodgerBlue|FireBrick|FloralWhite|ForestGreen|Fuchsia|Gainsboro|Gh
ostWhite|Gold|Goldenrod|Gr[ae]y|Green|GreenYellow|Honeydew|HotPink|IndianRed|Indigo|Ivory|Khaki|Lavender|LavenderBlush|LawnGreen|LemonChiffon|LightBlue|LightCoral|LightCyan|LightGoldenrodYellow|LightGreen|LightGrey|LightPink|LightSalmon|LightSeaGreen|LightSkyBlue|LightSlateGray|LightSteelBlue|LightYellow|Lime|LimeGreen|Linen|Magenta|Maroon|MediumAquamarine|MediumBlue|MediumOrchid|MediumPurple|MediumSeaGreen|MediumSlateBlue|MediumSpringGreen|MediumTurquoise|MediumVioletRed|MidnightBlue|MintCream|MistyRose|Moccasin|NavajoWhite|Navy|OldLace|Olive|OliveDrab|Orange|OrangeRed|Orchid|PaleGoldenrod|PaleGreen|PaleTurquoise|PaleVioletRed|PapayaWhip|PeachPuff|Peru|Pink|Plum|PowderBlue|Purple|Red|RosyBrown|RoyalBlue|SaddleBrown|Salmon|SandyBrown|SeaGreen|Seashell|Sienna|Silver|SkyBlue|SlateBlue|SlateGray|Snow|SpringGreen|SteelBlue|Tan|Teal|Thistle|Tomato|Turquoise|Violet|Wheat|White|WhiteSmoke|Yellow|YellowGreen|ActiveBorder|ActiveCaption|AppWorkspace|Background|Buttonface|ButtonHighligh
t|ButtonShadow|ButtonText|CaptionText|GrayText|Highlight|HighlightTex
|InfoText|Menu|MenuText|Scrollbar|ThreeDDarkShadow|ThreeDFace|ThreeDHighlight|ThreeDLightShadow|ThreeDShadow|Window(?:Frame|WindowText)?).{1,10}/i
score SARE_ILLEGAL_COLOR 1.666
describe SARE_ILLEGAL_COLOR Uses illegal color code
for catching things like:
color: #ff$f%f;
color="cooking"
color="RNDCLR[]" etc...
As I said before... any help, hints on whats going on and such is really
appriciated.
Jesse
SARE Ninja
