Magnus Holmgren wrote:
> I see a fair amount of spam using <TEXTAREA style="visibility: hidden"> to
> hide bayes poison. Shouldn't a rule against that, or CSS-hidden text in
> general, be worthwile? I couldn't find any in the default 3.1.1 ruleset, nor
> at SARE.
It certainly seems worth testing.
Here's a rule I wrote (caution: word-wraps.. this should be 3 lines long):
rawbody L_STYLE_HIDDEN /<TEXTAREA
[^>]{0,50}style\s?=\s?"\s?visibility:\s?hidden\s?"[^>]{0,50}>/i
describe L_STYLE_HIDDEN has text with hidden visibility style
score L_STYLE_HIDDEN 0.1
I added some allowance for other declarations in the textarea tag, and the
insertion of whitespace at various spots...
It may need further tweaking/tuning, but it's a first-stab.
