On 29 Oct 2018, at 9:55, Anders Gustafsson wrote:
Is there such a rule already in 3.3.x?
Do not run SpamAssassin 3.3.x. It is not safe. There have been multiple serious security bugs fixed in the 3.4.x series.
However, the rules for 3.3.x and 3.4.x are identical. And yes, the rule "NORMAL_HTTP_TO_IP" will catch http(s) URLs using dotted-quad IPs and "NUMERIC_HTTP_ADDR" will catch http(s) URLs using a single decimal number (which some resolvers will treat as an IP address)
I would ideally want a version of that that adds to the spam score if it sees a x.x.x.x/unsubscribe link, possibly translated.
IP_LINK_PLUS does something similar that could be adapted pretty easily.
Asking here as regexps are not really my strong side.
Well, if you look in the standard rule distribution (under /var/lib/spamassassin/ or somewhere similar, depending on your platform) you will find the file 20_uri_tests.cf, in which all of the standard URI-based rules are defined, many with comments. Even if you're not a wizard with regexps, you may be able to find rules there which you can adapt to your own needs with simple changes.
