On Mon, 2004-05-17 at 16:10, John Fawcett wrote:
> So the options are:
> - use unescaped \ as a spam indicator
> - mimic the broken browsers/email clients which are apparently rewriting
> malformed urls by mapping \ to /, thus allowing SpamCopURI to
> successfully retrieve the spammer domain for testing against surbl.
...do both:
describe HTML_BS_URI URL with many backslash-separated words
uri HTML_BS_URI /(\\[a-z0-9]+){5,}/i
score HTML_BS_URI 0.5
(n.b.: the modifier "BS" is overloaded here... :)
...and have SpamCopURI de-backslash the URI before performing the
redirector lookup. Note that I am unsure whether SA should do this
rewriting. SpamCopURI definitely should.
--
John Hardin KA7OHZ
Internal Systems Administrator voice: (425) 672-1304
Apropos Retail Management Systems, Inc. fax: (425) 672-0192
-----------------------------------------------------------------------
...the Fates notice those who buy chainsaws...
-- www.darwinawards.com
-----------------------------------------------------------------------
58 days until Apropos Forum 2004
