On Wed, 17 Mar 2004, Fetter, Aaron wrote:
> Your rule works great except for one thing. We get some mail with tiny font
> of 1 or 0 with the pt or px omitted from the html of the spam message:
> "Are you ready to lo<font style="font-size: 1;">
> It looks like spammers are doing this to get around rules like yours.
Yay. I've made the big time..... :-)
> happen to know how to modify your rule or how to create a new rule that
> wouldn't look to see if there is a pt or px after the font number?
The following rule tries to 'get ahead of the game' a little, looking for
some other obvious combinations: number followed by a space or by the
closing quote for the style attribute, plus numbers with decimal parts.
Mind the line wrap....
rawbody LOC_HTMLINVISTEXTZERO
/style=['"]?[^>"']*font-size: *[01](\.[0-9]*)?(?:p[tx]|[ ;"'>])/i
describe LOC_HTMLINVISTEXTZERO invisible text - zero/one point
score LOC_HTMLINVISTEXTZERO 1.8
Enjoy!
- Charles
