Feature request: HTML Content Checks

[Julian Field]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Is this okay?

HTML-Object
HTML-Script
HTML-Form
HTML-IFrame

with the same log line format as the current log iframe tags gives you.
I will remove the log iframe tags option and replace it with log html tags.


Quentin Campbell wrote:

>ulian
>
>Is it possible to add to the logged "Content Checks: Detected
>HTML-specific exploits in ..." messages the actual HTML exploit that
>caused the message?
>
>That is, I am asking for one of the strings "HTML-Iframe",
>"HTML-Codebase", "HTML Object", "HTML-Script" or "HTML-Form" to be added
>as appropriate to the message.
>
>At present we only have info on IFrame exploits through the separate
>logging facility for that tag. I would like this additional info for the
>same reason you provided the IFrame logging - to identify the
>envelope-From address that may need to be added to the rules file to
>exempt that address from the actions normally applied to that exploit.
>
>Thanks
>
>Quentin
>---
>PHONE: +44 191 222 8209    Information Systems and Services (ISS),
>                           University of Newcastle,
>                           Newcastle upon Tyne,
>FAX:   +44 191 222 8765    United Kingdom, NE1 7RU.
>------------------------------------------------------------------------
>"Any opinion expressed above is mine. The University can get its own."
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>
>
>

--
Julian Field
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!