Philip Prindeville wrote:
> /<[aA] [hH][rR][eE][fF]=.* (onMouseOver|onMouseMouse)="window\.status=/
You might want to change that regexp to something like:
/<a[^>]{1,200}href\s{0,10}=.{0,200}(onmouseover|onmousemouse)\s{0,10}=\s{0,10}"window\.status\s{0,10}=/i
You probably don't want to use the '*' quantifier in a SpamAssassin
rule regexp; it can exhibit very long execution time on long messages.
You might also want to not get sidetracked by people who add spaces to
throw you off. And you may as well make the whole thing
case-insensitive. Finally, you'd want to match something like
<a title="foo" href="bar" onMouseOver="..."> which the original regexp
would miss.
Regards,
David.
_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in the above
message, it is NULL AND VOID. You may ignore it.
Visit http://www.mimedefang.org and http://www.roaringpenguin.com
MIMEDefang mailing list [email protected]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
