exe extension in url

[James Gray]

    [ The following text is in the "utf-8" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

On Tuesday 10 January 2006 10:33, Matt Kettler wrote:
> James Gray wrote:
> > I have written a number of SpamAssassin rules that increase the score for
> > messages that link to executables (exe/dll/bat/etc... but NOT
> > ".com"...think about it :P).  Unfortunately some of them also hit
> > legitimate websites (like www.ht.com.au which uses a program called
> > "xworks.exe" for its dynamic content).
>
> Suggestion: use a $ to look for uris that END in .exe, instead of just
> looking for URIs that contain them. Most dynamic content sites using exe
> have parameters passed after it, such as the above site which ends in
> "/xworks.exe?M"
>
>
> Something like this would work:
>
>
> uri L_URI_EXE /\/.+\.exe$/i
> score L_URI_EXE 0.1
> describe L_URI_EXE Contains link to a .exe file

Good suggestion - done.  New tar ball uploaded and change logs edited.

> > <SHAMELESS_PLUG>
> > All my rules are available at http://files.grayonline.id.au - all the
> > URL/URI rules are in the "local_uri.cf" which is in the tar ball.  The
> > rest of the instructions are on the website.
> > </SHAMELESS_PLUG>
>
> Erm, you don't seem to have them in the 12/02/2005 tarball, which is the
> latest that's up there.

Really?  It was in there when I opened it.  Anyway, there's a new tar ball 
dated 10-Jan-2006 that I KNOW has the local_uri.cf file in it.

Cheers,

James

> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
James
-- 
It's hard to argue that God hated Oklahoma.  If He didn't, why is it so
close to Texas?

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!