Hello David,

Thursday, June 3, 2004, 8:49:33 PM, you wrote:

DBF> On Thu, 3 Jun 2004, Scott Rothgaber wrote:

>> SA caught this one with the new Bayes poison rule but it missed the tiny
>> font. I took a peek at 20_html_tests.cf but I'm Perl-impaired.  :( Can
>> anyone suggest a way to catch this:
>> <font style=3Dfont-size:1px>

DBF> Got this from a posting by Bob Menschel some time back:
DBF> rawbody  RM_rbh_0ptFont
DBF>            /\bfont-size:[\s"]?[01]p[tx]\b|\bstyle="font-size: ?1;"/i
DBF> describe RM_rbh_0ptFont  HTML includes zero-point font size; invisible text
DBF> score    RM_rbh_0ptFont  1.865

Rule is now SARE_HTML_FSIZE2 in 70_sare_html1.cf at
http://www.rulesemporium.com/rules.htm#html
rawbody   SARE_HTML_FSIZE2         /font-size:\s*[0-4]p[tx]\b/i

Results against my corpus:
OVERALL     SPAM      HAM     S/O          SCORE  NAME
  85861    63662    22199    0.741   0.00   0.00  (all messages)
   5666     5658        8    0.996   0.98   1.67  SARE_HTML_FSIZE2


Bob Menschel



Reply via email to