exe extension in url

[Matt Kettler]

    [ The following text is in the "UTF-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

James Gray wrote:

> I have written a number of SpamAssassin rules that increase the score for 
> messages that link to executables (exe/dll/bat/etc... but NOT ".com"...think 
> about it :P).  Unfortunately some of them also hit legitimate websites (like 
> www.ht.com.au which uses a program called "xworks.exe" for its dynamic 
> content).

Suggestion: use a $ to look for uris that END in .exe, instead of just looking
for URIs that contain them. Most dynamic content sites using exe have parameters
passed after it, such as the above site which ends in "/xworks.exe?M"


Something like this would work:


uri L_URI_EXE /\/.+\.exe$/i
score L_URI_EXE 0.1
describe L_URI_EXE Contains link to a .exe file


> 
> <SHAMELESS_PLUG>
> All my rules are available at http://files.grayonline.id.au - all the URL/URI 
> rules are in the "local_uri.cf" which is in the tar ball.  The rest of the 
> instructions are on the website.
> </SHAMELESS_PLUG>

Erm, you don't seem to have them in the 12/02/2005 tarball, which is the latest
that's up there.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!