home *** CD-ROM | disk | FTP | other *** search
/ Enter 2005 December / enter-cd-12-2005.iso / Internet / SpamAware 4.0 / SpamAware-Setup.exe / {app} / rules / 20_meta_tests.cf < prev    next >
Encoding:
Text File  |  2005-06-20  |  10.8 KB  |  134 lines

  1. # SpamAssassin rules file: meta tests
  2. #
  3. # Please don't modify this file as your changes will be overwritten with
  4. # the next update. Use @@LOCAL_RULES_DIR@@/local.cf instead.
  5. # See 'perldoc Mail::SpamAssassin::Conf' for details.
  6. #
  7. # Add meta tests which cover *both* headers and body here.
  8. #
  9. # Note: body tests are run with long lines, so be sure to limit the
  10. # size of searches; use /.{0,30}/ instead of /.*/ to avoid huge
  11. # search times.
  12. #
  13. # <@LICENSE>
  14. # Copyright 2004 Apache Software Foundation
  15. # Licensed under the Apache License, Version 2.0 (the "License");
  16. # you may not use this file except in compliance with the License.
  17. # You may obtain a copy of the License at
  18. #     http://www.apache.org/licenses/LICENSE-2.0
  19. # Unless required by applicable law or agreed to in writing, software
  20. # distributed under the License is distributed on an "AS IS" BASIS,
  21. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  22. # See the License for the specific language governing permissions and
  23. # limitations under the License.
  24. # </@LICENSE>
  25. #
  26. ###########################################################################
  27.  
  28. require_version @@VERSION@@
  29.  
  30. # some tests that will trigger FPs on ISO-2022-JP mails.
  31.  
  32. body __ISO_2022_JP_DELIM    /\e\$B/
  33.  
  34. header __MANY_EXCLS             Subject =~ /![^!]+!/
  35. header __PLING_PLING            Subject =~ /!!!/
  36.  
  37. body __UPPERCASE_25_50          eval:check_for_uppercase('25', '50')
  38. body __UPPERCASE_50_75          eval:check_for_uppercase('50', '75')
  39. body __UPPERCASE_75_100         eval:check_for_uppercase('75', '100')
  40.  
  41. meta MANY_EXCLAMATIONS          (!__ISO_2022_JP_DELIM && __MANY_EXCLS)
  42. describe MANY_EXCLAMATIONS      Subject has many exclamations
  43. meta UPPERCASE_25_50            (!__ISO_2022_JP_DELIM && __UPPERCASE_25_50)
  44. describe UPPERCASE_25_50        message body is 25-50% uppercase
  45. meta UPPERCASE_50_75            (!__ISO_2022_JP_DELIM && __UPPERCASE_50_75)
  46. describe UPPERCASE_50_75        message body is 50-75% uppercase
  47. meta UPPERCASE_75_100           (!__ISO_2022_JP_DELIM && __UPPERCASE_75_100)
  48. describe UPPERCASE_75_100       message body is 75-100% uppercase
  49. meta PLING_PLING                (!__ISO_2022_JP_DELIM && __PLING_PLING)
  50. describe PLING_PLING            Subject has lots of exclamation marks
  51.  
  52. ##############################################################################
  53.  
  54. # tvd - I really wish there was a better way to do this, but ...
  55. # perhaps make a quick eval that counts how many matches, then we use
  56. # the cached result in tests?
  57.  
  58. meta NIGERIAN_BODY1    ( __NIGERIAN_BODY_1 + __NIGERIAN_BODY_2 + __NIGERIAN_BODY_3 + __NIGERIAN_BODY_5 + __NIGERIAN_BODY_6 + __NIGERIAN_BODY_7 + __NIGERIAN_BODY_8 + __NIGERIAN_BODY_9 + __NIGERIAN_BODY_10 + __NIGERIAN_BODY_11 + __NIGERIAN_BODY_12 + __NIGERIAN_BODY_13 + __NIGERIAN_BODY_14 + __NIGERIAN_BODY_15 + __NIGERIAN_BODY_16 + __NIGERIAN_BODY_17 + __NIGERIAN_BODY_18 + __NIGERIAN_BODY_19 + __NIGERIAN_BODY_20 + __NIGERIAN_BODY_21 + __NIGERIAN_BODY_22 + __NIGERIAN_BODY_25 + __NIGERIAN_BODY_26 + __NIGERIAN_BODY_27 + __NIGERIAN_BODY_28 + __NIGERIAN_BODY_29 + __NIGERIAN_BODY_30 + __NIGERIAN_BODY_31 + __NIGERIAN_BODY_32 + __NIGERIAN_BODY_33 + __NIGERIAN_BODY_34 + __NIGERIAN_BODY_35 + __NIGERIAN_BODY_36 + __NIGERIAN_BODY_37 + __NIGERIAN_BODY_38 + __NIGERIAN_BODY_39 + __NIGERIAN_BODY_40 + __NIGERIAN_BODY_41 + __NIGERIAN_BODY_42 + __NIGERIAN_BODY_43 + __NIGERIAN_BODY_44 + __NIGERIAN_BODY_45 + __NIGERIAN_BODY_46 ) > 1
  59. describe NIGERIAN_BODY1    Message body looks like a Nigerian spam message 1+
  60.  
  61. meta NIGERIAN_BODY2    ( __NIGERIAN_BODY_1 + __NIGERIAN_BODY_2 + __NIGERIAN_BODY_3 + __NIGERIAN_BODY_5 + __NIGERIAN_BODY_6 + __NIGERIAN_BODY_7 + __NIGERIAN_BODY_8 + __NIGERIAN_BODY_9 + __NIGERIAN_BODY_10 + __NIGERIAN_BODY_11 + __NIGERIAN_BODY_12 + __NIGERIAN_BODY_13 + __NIGERIAN_BODY_14 + __NIGERIAN_BODY_15 + __NIGERIAN_BODY_16 + __NIGERIAN_BODY_17 + __NIGERIAN_BODY_18 + __NIGERIAN_BODY_19 + __NIGERIAN_BODY_20 + __NIGERIAN_BODY_21 + __NIGERIAN_BODY_22 + __NIGERIAN_BODY_25 + __NIGERIAN_BODY_26 + __NIGERIAN_BODY_27 + __NIGERIAN_BODY_28 + __NIGERIAN_BODY_29 + __NIGERIAN_BODY_30 + __NIGERIAN_BODY_31 + __NIGERIAN_BODY_32 + __NIGERIAN_BODY_33 + __NIGERIAN_BODY_34 + __NIGERIAN_BODY_35 + __NIGERIAN_BODY_36 + __NIGERIAN_BODY_37 + __NIGERIAN_BODY_38 + __NIGERIAN_BODY_39 + __NIGERIAN_BODY_40 + __NIGERIAN_BODY_41 + __NIGERIAN_BODY_42 + __NIGERIAN_BODY_43 + __NIGERIAN_BODY_44 + __NIGERIAN_BODY_45 + __NIGERIAN_BODY_46 ) > 2
  62. describe NIGERIAN_BODY2    Message body looks like a Nigerian spam message 2+
  63.  
  64. meta NIGERIAN_BODY3    ( __NIGERIAN_BODY_1 + __NIGERIAN_BODY_2 + __NIGERIAN_BODY_3 + __NIGERIAN_BODY_5 + __NIGERIAN_BODY_6 + __NIGERIAN_BODY_7 + __NIGERIAN_BODY_8 + __NIGERIAN_BODY_9 + __NIGERIAN_BODY_10 + __NIGERIAN_BODY_11 + __NIGERIAN_BODY_12 + __NIGERIAN_BODY_13 + __NIGERIAN_BODY_14 + __NIGERIAN_BODY_15 + __NIGERIAN_BODY_16 + __NIGERIAN_BODY_17 + __NIGERIAN_BODY_18 + __NIGERIAN_BODY_19 + __NIGERIAN_BODY_20 + __NIGERIAN_BODY_21 + __NIGERIAN_BODY_22 + __NIGERIAN_BODY_25 + __NIGERIAN_BODY_26 + __NIGERIAN_BODY_27 + __NIGERIAN_BODY_28 + __NIGERIAN_BODY_29 + __NIGERIAN_BODY_30 + __NIGERIAN_BODY_31 + __NIGERIAN_BODY_32 + __NIGERIAN_BODY_33 + __NIGERIAN_BODY_34 + __NIGERIAN_BODY_35 + __NIGERIAN_BODY_36 + __NIGERIAN_BODY_37 + __NIGERIAN_BODY_38 + __NIGERIAN_BODY_39 + __NIGERIAN_BODY_40 + __NIGERIAN_BODY_41 + __NIGERIAN_BODY_42 + __NIGERIAN_BODY_43 + __NIGERIAN_BODY_44 + __NIGERIAN_BODY_45 + __NIGERIAN_BODY_46 ) > 3
  65. describe NIGERIAN_BODY3    Message body looks like a Nigerian spam message 3+
  66.  
  67. meta NIGERIAN_BODY4    ( __NIGERIAN_BODY_1 + __NIGERIAN_BODY_2 + __NIGERIAN_BODY_3 + __NIGERIAN_BODY_5 + __NIGERIAN_BODY_6 + __NIGERIAN_BODY_7 + __NIGERIAN_BODY_8 + __NIGERIAN_BODY_9 + __NIGERIAN_BODY_10 + __NIGERIAN_BODY_11 + __NIGERIAN_BODY_12 + __NIGERIAN_BODY_13 + __NIGERIAN_BODY_14 + __NIGERIAN_BODY_15 + __NIGERIAN_BODY_16 + __NIGERIAN_BODY_17 + __NIGERIAN_BODY_18 + __NIGERIAN_BODY_19 + __NIGERIAN_BODY_20 + __NIGERIAN_BODY_21 + __NIGERIAN_BODY_22 + __NIGERIAN_BODY_25 + __NIGERIAN_BODY_26 + __NIGERIAN_BODY_27 + __NIGERIAN_BODY_28 + __NIGERIAN_BODY_29 + __NIGERIAN_BODY_30 + __NIGERIAN_BODY_31 + __NIGERIAN_BODY_32 + __NIGERIAN_BODY_33 + __NIGERIAN_BODY_34 + __NIGERIAN_BODY_35 + __NIGERIAN_BODY_36 + __NIGERIAN_BODY_37 + __NIGERIAN_BODY_38 + __NIGERIAN_BODY_39 + __NIGERIAN_BODY_40 + __NIGERIAN_BODY_41 + __NIGERIAN_BODY_42 + __NIGERIAN_BODY_43 + __NIGERIAN_BODY_44 + __NIGERIAN_BODY_45 + __NIGERIAN_BODY_46 ) > 4
  68. describe NIGERIAN_BODY4    Message body looks like a Nigerian spam message 4+
  69.  
  70. body __NIGERIAN_BODY_1        /\b(?:financial|confiden(?:tial|ce)|safe|mutual|secret|success|risk-?free|details|business).{1,30}\btransaction\b/i
  71. body __NIGERIAN_BODY_2        /\btransaction\b.{1,30}\b(?:magnitude|diplomatic|strict|absolute|secret|confiden(?:tial|ce)|guarantee)/i
  72. body __NIGERIAN_BODY_3        /BASED ON INFORMATION GATHERED ABOUT YOU, WE BELIEVE\s*YOU WOULD BE IN A POSITION TO HELP US IN TRANSFER/i
  73. body __NIGERIAN_BODY_5        /\bpoisoned (?:to death )?by his business associate/i
  74. body __NIGERIAN_BODY_6        /\bIt is with trust and confidentiality\b/i
  75. body __NIGERIAN_BODY_7        /\bU\.?S\.?(?:D\.?)?\s*(?:\$\s*)?(?:\d+,\d+,\d+|\d+\.\d+\.\d+|\d+(?:\.\d+)?\s*milli?on)/i
  76. body __NIGERIAN_BODY_8        /\b(?:You may be sur?prised to receive this letter from me|this (?:letter|mail) (?:(?:may|will) come to you as|will be) a sur?prise)\b/i
  77. body __NIGERIAN_BODY_9        /\bthe .{1,10} son of\b/i
  78. body __NIGERIAN_BODY_10        /\burgent and(?: very)? (?:profitable|confidential) business (?:proposal|proposition)\b/i
  79. body __NIGERIAN_BODY_11        /\bassistance to relocate\b/i
  80. body __NIGERIAN_BODY_12        /\bto which will be transferred the sum\b/i
  81. body __NIGERIAN_BODY_13        /\byour(?: private)? (?:tele)?phone (?:and|&) fax Numbers?\b/i
  82. body __NIGERIAN_BODY_14        /\bthe importance of Secrecy\b/i
  83. body __NIGERIAN_BODY_15        /\bmodalities\b/i
  84. body __NIGERIAN_BODY_16        /\bI am a Private Investigator\b/i
  85. body __NIGERIAN_BODY_17        /\bWRITING THIS LETTER TO SOLICIT\b/i
  86. body __NIGERIAN_BODY_18        /\bSEVERAL ATTEMPTS HAVE BEEN MADE WITH OUT SUCCESS\b/i
  87. body __NIGERIAN_BODY_19        /\bMY PROPOSAL IS ACCEPTABLE\b/i
  88. body __NIGERIAN_BODY_20        /\d+%.{0,15}\)? (?:of (?:the total|this|the) (?:amount|sum|money)|for you|for my investment|for (?:us|me)|.{0,15}\bfor your expenses)\b/i
  89. body __NIGERIAN_BODY_21        /\bforeign account\b/i
  90. body __NIGERIAN_BODY_22        /\btrust (?:and|&) confidentiality\b/i
  91. body __NIGERIAN_BODY_25        /\bvery beneficial to both of us\b/i
  92. body __NIGERIAN_BODY_26        /\bmilli?on (?:.{1,25} thousand\s*)?(?:(?:united states|u\.?s\.?) dollars|(?i:U\.?S\.?D?))\b/i
  93. body __NIGERIAN_BODY_27        /\bcorrespondent branch\b/i
  94. body __NIGERIAN_BODY_28        /\btransaction is .{1,15} risk free.\b/i
  95. body __NIGERIAN_BODY_29        /\b(?:percentage|rate) of this money\b/i
  96. body __NIGERIAN_BODY_30        /\bfavou?rable response\b/i
  97. body __NIGERIAN_BODY_31        /\btotal acceptance and commitment\b/i
  98. body __NIGERIAN_BODY_32        /\blocate(?: .{1,20})? extended relative/i
  99. body __NIGERIAN_BODY_33        /\bhonest cooperation\b/i
  100. body __NIGERIAN_BODY_34        /\b(?:wife|son|brother|daughter) of the late\b/i
  101. body __NIGERIAN_BODY_35        /\bintuitive confidence/i
  102. body __NIGERIAN_BODY_36        /\battached to ticket number\b/i
  103. body __NIGERIAN_BODY_37        /\ball funds will be returned\b/i
  104. body __NIGERIAN_BODY_38        /\b(?:International\b.{1,15}\bLottery|lottery\b.{1,15}\binternational)\b/i
  105. body __NIGERIAN_BODY_39        /\bYOUR FULL NAMES?,?(?:and|&)? FULL CONTACT ADDRESS\b/i
  106. body __NIGERIAN_BODY_40        /\bsend .{1,30}\byour telefax Numbers?\b/i
  107. body __NIGERIAN_BODY_41        /(?:government|bank) of nigeria/i
  108. body __NIGERIAN_BODY_42        /nigerian? (?:national|government)/i
  109. body __NIGERIAN_BODY_43         /\blate .{0,15}(?:father|wife|husband|general|president|daughter|son|minister).{0,20}(?:wealthy|treasure|deposit|money|left|property|known|\$|US)/i
  110. body __NIGERIAN_BODY_44         /\b(?:of|the) late president\b/i
  111. body __NIGERIAN_BODY_45         /\bsum of ?(?:million|US|\$)|\b(?:deposit|left|huge|discovered|abandoned).{0,15} sum of/i
  112. body __NIGERIAN_BODY_46         /\bgive\s+you .{0,15}(?:fund|money|total|sum|contact|percent)\b/i
  113.  
  114. ##############################################################################
  115.  
  116. header __SANE_MSGID        MESSAGEID =~ /^<[^<>\\ \t\n\r\x0b\x80-\xff]+\@[^<>\\ \t\n\r\x0b\x80-\xff]+>\s*$/m
  117. header __HAS_MSGID        MESSAGEID =~ /\S/
  118. header __MSGID_COMMENT        MESSAGEID =~ /\(.*\)/m
  119. meta INVALID_MSGID        __HAS_MSGID && !(__SANE_MSGID || __MSGID_COMMENT)
  120. describe INVALID_MSGID        Message-Id is not valid, according to RFC 2822
  121.  
  122. header __MOZILLA_MUA        X-Mailer =~ /\bMozilla\b/
  123. header __MOZILLA_MSGID        MESSAGEID =~ /^<[A-F\d]{8}\.[A-F1-9][A-F\d]{0,7}\@\S+>$/m
  124. meta FORGED_MUA_MOZILLA        (__MOZILLA_MUA && !__UNUSABLE_MSGID && !__MOZILLA_MSGID)
  125. describe FORGED_MUA_MOZILLA    Forged mail pretending to be from Mozilla
  126.  
  127. header __PC_RND_HEADER        ALL =~ /%RA?ND(?:OM)?_[A-Z]/i
  128. body __PC_RND_BODY        /%RA?ND(?:OM)?_[A-Z]/i
  129. rawbody __PC_RND_RAWBODY    /%RA?ND(?:OM)?_[A-Z]/i
  130. meta PERCENT_RANDOM    (__PC_RND_HEADER || __PC_RND_BODY || __PC_RND_RAWBODY)
  131.