home *** CD-ROM | disk | FTP | other *** search
/ Enter 2004 June / EnterCD 06_2004.iso / Internet / Bloomba 1.0.6 / Bloomba1706Installer.exe / saproxy / Disk1 / data1.cab / rules / 20_meta_tests.cf < prev    next >
Encoding:
Text File  |  2004-03-01  |  11.3 KB  |  139 lines

  1. # SpamAssassin rules file: meta tests
  2. #
  3. # Please don't modify this file as your changes will be overwritten with
  4. # the next update. Use @@LOCAL_RULES_DIR@@/local.cf instead.
  5. # See 'perldoc Mail::SpamAssassin::Conf' for details.
  6. #
  7. # This program is free software; you can redistribute it and/or modify
  8. # it under the terms of either the Artistic License or the GNU General
  9. # Public License as published by the Free Software Foundation; either
  10. # version 1 of the License, or (at your option) any later version.
  11. #
  12. # See the file "License" in the top level of the SpamAssassin source
  13. # distribution for more details.
  14. #
  15. # Add meta tests which cover *both* headers and body here.
  16. #
  17. # Note: body tests are run with long lines, so be sure to limit the
  18. # size of searches; use /.{0,30}/ instead of /.*/ to avoid huge
  19. # search times.
  20. #
  21. ###########################################################################
  22.  
  23. require_version @@VERSION@@
  24.  
  25. # some tests that will trigger FPs on ISO-2022-JP mails.
  26.  
  27. body __ISO_2022_JP_DELIM    /\e\$B/
  28.  
  29. body __THREE_DOLLARS        /\${3,}/
  30. header __MANY_EXCLS             Subject =~ /![^!]+!/
  31. header __PLING_PLING            Subject =~ /!!!/
  32.  
  33. body __UPPERCASE_25_50          eval:check_for_uppercase('25', '50')
  34. body __UPPERCASE_50_75          eval:check_for_uppercase('50', '75')
  35. body __UPPERCASE_75_100         eval:check_for_uppercase('75', '100')
  36.  
  37. meta CASHCASHCASH        (!__ISO_2022_JP_DELIM && __THREE_DOLLARS)
  38. describe CASHCASHCASH        Contains at least 3 dollar signs in a row
  39. meta MANY_EXCLAMATIONS          (!__ISO_2022_JP_DELIM && __MANY_EXCLS)
  40. describe MANY_EXCLAMATIONS      Subject has many exclamations
  41. meta UPPERCASE_25_50            (!__ISO_2022_JP_DELIM && __UPPERCASE_25_50)
  42. describe UPPERCASE_25_50        message body is 25-50% uppercase
  43. meta UPPERCASE_50_75            (!__ISO_2022_JP_DELIM && __UPPERCASE_50_75)
  44. describe UPPERCASE_50_75        message body is 50-75% uppercase
  45. meta UPPERCASE_75_100           (!__ISO_2022_JP_DELIM && __UPPERCASE_75_100)
  46. describe UPPERCASE_75_100       message body is 75-100% uppercase
  47. meta PLING_PLING                (!__ISO_2022_JP_DELIM && __PLING_PLING)
  48. describe PLING_PLING            Subject has lots of exclamation marks
  49.  
  50. ##############################################################################
  51.  
  52. # tvd - I really wish there was a better way to do this, but ...
  53. # perhaps make a quick eval that counts how many matches, then we use
  54. # the cached result in tests?
  55.  
  56. meta NIGERIAN_BODY1    ( __NIGERIAN_BODY_1 + __NIGERIAN_BODY_2 + __NIGERIAN_BODY_3 + __NIGERIAN_BODY_5 + __NIGERIAN_BODY_6 + __NIGERIAN_BODY_7 + __NIGERIAN_BODY_8 + __NIGERIAN_BODY_9 + __NIGERIAN_BODY_10 + __NIGERIAN_BODY_11 + __NIGERIAN_BODY_12 + __NIGERIAN_BODY_13 + __NIGERIAN_BODY_14 + __NIGERIAN_BODY_15 + __NIGERIAN_BODY_16 + __NIGERIAN_BODY_17 + __NIGERIAN_BODY_18 + __NIGERIAN_BODY_19 + __NIGERIAN_BODY_20 + __NIGERIAN_BODY_21 + __NIGERIAN_BODY_22 + __NIGERIAN_BODY_25 + __NIGERIAN_BODY_26 + __NIGERIAN_BODY_27 + __NIGERIAN_BODY_28 + __NIGERIAN_BODY_29 + __NIGERIAN_BODY_30 + __NIGERIAN_BODY_31 + __NIGERIAN_BODY_32 + __NIGERIAN_BODY_33 + __NIGERIAN_BODY_34 + __NIGERIAN_BODY_35 + __NIGERIAN_BODY_36 + __NIGERIAN_BODY_37 + __NIGERIAN_BODY_38 + __NIGERIAN_BODY_39 + __NIGERIAN_BODY_40 + __NIGERIAN_BODY_41 + __NIGERIAN_BODY_42 + __NIGERIAN_BODY_43 + __NIGERIAN_BODY_44 + __NIGERIAN_BODY_45 + __NIGERIAN_BODY_46 ) > 1
  57. describe NIGERIAN_BODY1    Message body looks like a Nigerian spam message 1+
  58.  
  59. meta NIGERIAN_BODY2    ( __NIGERIAN_BODY_1 + __NIGERIAN_BODY_2 + __NIGERIAN_BODY_3 + __NIGERIAN_BODY_5 + __NIGERIAN_BODY_6 + __NIGERIAN_BODY_7 + __NIGERIAN_BODY_8 + __NIGERIAN_BODY_9 + __NIGERIAN_BODY_10 + __NIGERIAN_BODY_11 + __NIGERIAN_BODY_12 + __NIGERIAN_BODY_13 + __NIGERIAN_BODY_14 + __NIGERIAN_BODY_15 + __NIGERIAN_BODY_16 + __NIGERIAN_BODY_17 + __NIGERIAN_BODY_18 + __NIGERIAN_BODY_19 + __NIGERIAN_BODY_20 + __NIGERIAN_BODY_21 + __NIGERIAN_BODY_22 + __NIGERIAN_BODY_25 + __NIGERIAN_BODY_26 + __NIGERIAN_BODY_27 + __NIGERIAN_BODY_28 + __NIGERIAN_BODY_29 + __NIGERIAN_BODY_30 + __NIGERIAN_BODY_31 + __NIGERIAN_BODY_32 + __NIGERIAN_BODY_33 + __NIGERIAN_BODY_34 + __NIGERIAN_BODY_35 + __NIGERIAN_BODY_36 + __NIGERIAN_BODY_37 + __NIGERIAN_BODY_38 + __NIGERIAN_BODY_39 + __NIGERIAN_BODY_40 + __NIGERIAN_BODY_41 + __NIGERIAN_BODY_42 + __NIGERIAN_BODY_43 + __NIGERIAN_BODY_44 + __NIGERIAN_BODY_45 + __NIGERIAN_BODY_46 ) > 2
  60. describe NIGERIAN_BODY2    Message body looks like a Nigerian spam message 2+
  61.  
  62. meta NIGERIAN_BODY3    ( __NIGERIAN_BODY_1 + __NIGERIAN_BODY_2 + __NIGERIAN_BODY_3 + __NIGERIAN_BODY_5 + __NIGERIAN_BODY_6 + __NIGERIAN_BODY_7 + __NIGERIAN_BODY_8 + __NIGERIAN_BODY_9 + __NIGERIAN_BODY_10 + __NIGERIAN_BODY_11 + __NIGERIAN_BODY_12 + __NIGERIAN_BODY_13 + __NIGERIAN_BODY_14 + __NIGERIAN_BODY_15 + __NIGERIAN_BODY_16 + __NIGERIAN_BODY_17 + __NIGERIAN_BODY_18 + __NIGERIAN_BODY_19 + __NIGERIAN_BODY_20 + __NIGERIAN_BODY_21 + __NIGERIAN_BODY_22 + __NIGERIAN_BODY_25 + __NIGERIAN_BODY_26 + __NIGERIAN_BODY_27 + __NIGERIAN_BODY_28 + __NIGERIAN_BODY_29 + __NIGERIAN_BODY_30 + __NIGERIAN_BODY_31 + __NIGERIAN_BODY_32 + __NIGERIAN_BODY_33 + __NIGERIAN_BODY_34 + __NIGERIAN_BODY_35 + __NIGERIAN_BODY_36 + __NIGERIAN_BODY_37 + __NIGERIAN_BODY_38 + __NIGERIAN_BODY_39 + __NIGERIAN_BODY_40 + __NIGERIAN_BODY_41 + __NIGERIAN_BODY_42 + __NIGERIAN_BODY_43 + __NIGERIAN_BODY_44 + __NIGERIAN_BODY_45 + __NIGERIAN_BODY_46 ) > 3
  63. describe NIGERIAN_BODY3    Message body looks like a Nigerian spam message 3+
  64.  
  65. meta NIGERIAN_BODY4    ( __NIGERIAN_BODY_1 + __NIGERIAN_BODY_2 + __NIGERIAN_BODY_3 + __NIGERIAN_BODY_5 + __NIGERIAN_BODY_6 + __NIGERIAN_BODY_7 + __NIGERIAN_BODY_8 + __NIGERIAN_BODY_9 + __NIGERIAN_BODY_10 + __NIGERIAN_BODY_11 + __NIGERIAN_BODY_12 + __NIGERIAN_BODY_13 + __NIGERIAN_BODY_14 + __NIGERIAN_BODY_15 + __NIGERIAN_BODY_16 + __NIGERIAN_BODY_17 + __NIGERIAN_BODY_18 + __NIGERIAN_BODY_19 + __NIGERIAN_BODY_20 + __NIGERIAN_BODY_21 + __NIGERIAN_BODY_22 + __NIGERIAN_BODY_25 + __NIGERIAN_BODY_26 + __NIGERIAN_BODY_27 + __NIGERIAN_BODY_28 + __NIGERIAN_BODY_29 + __NIGERIAN_BODY_30 + __NIGERIAN_BODY_31 + __NIGERIAN_BODY_32 + __NIGERIAN_BODY_33 + __NIGERIAN_BODY_34 + __NIGERIAN_BODY_35 + __NIGERIAN_BODY_36 + __NIGERIAN_BODY_37 + __NIGERIAN_BODY_38 + __NIGERIAN_BODY_39 + __NIGERIAN_BODY_40 + __NIGERIAN_BODY_41 + __NIGERIAN_BODY_42 + __NIGERIAN_BODY_43 + __NIGERIAN_BODY_44 + __NIGERIAN_BODY_45 + __NIGERIAN_BODY_46 ) > 4
  66. describe NIGERIAN_BODY4    Message body looks like a Nigerian spam message 4+
  67.  
  68. body __NIGERIAN_BODY_1        /\b(?:financial|confiden(?:tial|ce)|safe|mutual|secret|success|risk-?free|details|business).{1,30}\btransaction\b/i
  69. body __NIGERIAN_BODY_2        /\btransaction\b.{1,30}\b(?:magnitude|diplomatic|strict|absolute|secret|confiden(?:tial|ce)|guarantee)/i
  70. body __NIGERIAN_BODY_3        /BASED ON INFORMATION GATHERED ABOUT YOU, WE BELIEVE\s*YOU WOULD BE IN A POSITION TO HELP US IN TRANSFER/i
  71. body __NIGERIAN_BODY_5        /\bpoisoned (?:to death )?by his business associate/i
  72. body __NIGERIAN_BODY_6        /\bIt is with trust and confidentiality\b/i
  73. body __NIGERIAN_BODY_7        /\bU\.?S\.?(?:D\.?)?\s*(?:\$\s*)?(?:\d+,\d+,\d+|\d+\.\d+\.\d+|\d+(?:\.\d+)?\s*milli?on)/i
  74. body __NIGERIAN_BODY_8        /\b(?:You may be sur?prised to receive this letter from me|this (?:letter|mail) (?:(?:may|will) come to you as|will be) a sur?prise)\b/i
  75. body __NIGERIAN_BODY_9        /\bthe .{1,10} son of\b/i
  76. body __NIGERIAN_BODY_10        /\burgent and(?: very)? (?:profitable|confidential) business (?:proposal|proposition)\b/i
  77. body __NIGERIAN_BODY_11        /\bassistance to relocate\b/i
  78. body __NIGERIAN_BODY_12        /\bto which will be transferred the sum\b/i
  79. body __NIGERIAN_BODY_13        /\byour(?: private)? (?:tele)?phone (?:and|&) fax Numbers?\b/i
  80. body __NIGERIAN_BODY_14        /\bthe importance of Secrecy\b/i
  81. body __NIGERIAN_BODY_15        /\bmodalities\b/i
  82. body __NIGERIAN_BODY_16        /\bI am a Private Investigator\b/i
  83. body __NIGERIAN_BODY_17        /\bWRITING THIS LETTER TO SOLICIT\b/i
  84. body __NIGERIAN_BODY_18        /\bSEVERAL ATTEMPTS HAVE BEEN MADE WITH OUT SUCCESS\b/i
  85. body __NIGERIAN_BODY_19        /\bMY PROPOSAL IS ACCEPTABLE\b/i
  86. body __NIGERIAN_BODY_20        /\d+%.{0,15}\)? (?:of (?:the total|this|the) (?:amount|sum|money)|for you|for my investment|for (?:us|me)|.{0,15}\bfor your expenses)\b/i
  87. body __NIGERIAN_BODY_21        /\bforeign account\b/i
  88. body __NIGERIAN_BODY_22        /\btrust (?:and|&) confidentiality\b/i
  89. body __NIGERIAN_BODY_25        /\bvery beneficial to both of us\b/i
  90. body __NIGERIAN_BODY_26        /\bmilli?on (?:.{1,25} thousand\s*)?(?:(?:united states|u\.?s\.?) dollars|(?i:U\.?S\.?D?))\b/i
  91. body __NIGERIAN_BODY_27        /\bcorrespondent branch\b/i
  92. body __NIGERIAN_BODY_28        /\btransaction is .{1,15} risk free.\b/i
  93. body __NIGERIAN_BODY_29        /\b(?:percentage|rate) of this money\b/i
  94. body __NIGERIAN_BODY_30        /\bfavou?rable response\b/i
  95. body __NIGERIAN_BODY_31        /\btotal acceptance and commitment\b/i
  96. body __NIGERIAN_BODY_32        /\blocate(?: .{1,20})? extended relative/i
  97. body __NIGERIAN_BODY_33        /\bhonest cooperation\b/i
  98. body __NIGERIAN_BODY_34        /\b(?:wife|son|brother|daughter) of the late\b/i
  99. body __NIGERIAN_BODY_35        /\bintuitive confidence/i
  100. body __NIGERIAN_BODY_36        /\battached to ticket number\b/i
  101. body __NIGERIAN_BODY_37        /\ball funds will be returned\b/i
  102. body __NIGERIAN_BODY_38        /\b(?:International\b.{1,15}\bLottery|lottery\b.{1,15}\binternational)\b/i
  103. body __NIGERIAN_BODY_39        /\bYOUR FULL NAMES?,?(?:and|&)? FULL CONTACT ADDRESS\b/i
  104. body __NIGERIAN_BODY_40        /\bsend .{1,30}\byour telefax Numbers?\b/i
  105. body __NIGERIAN_BODY_41        /(?:government|bank) of nigeria/i
  106. body __NIGERIAN_BODY_42        /nigerian? (?:national|government)/i
  107. body __NIGERIAN_BODY_43         /\blate .{0,15}(?:father|wife|husband|general|president|daughter|son|minister).{0,20}(?:wealthy|treasure|deposit|money|left|property|known|\$|US)/i
  108. body __NIGERIAN_BODY_44         /\b(?:of|the) late president\b/i
  109. body __NIGERIAN_BODY_45         /\bsum of ?(?:million|US|\$)|(?:deposit|left|huge|discovered|abandoned).{0,15} sum of/i
  110. body __NIGERIAN_BODY_46         /\bgive\s+you .{0,15}(?:fund|money|total|sum|contact|percent)\b/i
  111.  
  112. ##############################################################################
  113.  
  114. header __IDENT_NOBODY        Received =~ /ident[:=]nobody\b/i
  115. header __REGSITE_COM        Received =~ /\.registeredsite\.com\s/
  116. header __X_BEENTHERE        exists:X-BeenThere
  117. header __IDENT_NOBODY_LOCALHOST Received =~ /\bident[:=]nobody\@localhost\b/i
  118. body   __FORGOTTEN_PASSWORD     /[fF]org[oe]t.{0,25}[pP]assword/
  119. header __KNOWN_MAILING_LIST     eval:detect_mailing_list()
  120. meta IDENT_NOBODY        (__IDENT_NOBODY && !__IDENT_NOBODY_LOCALHOST && !__REGSITE_COM && !((__FORGOTTEN_PASSWORD + __X_BEENTHERE + __KNOWN_MAILING_LIST) > 1))
  121. describe IDENT_NOBODY        Received lines include an 'ident:nobody' string
  122.  
  123. header __SANE_MSGID        MESSAGEID =~ /^<[^<>\\ \t\n\r\x0b\x80-\xff]+\@[^<>\\ \t\n\r\x0b\x80-\xff]+>\s*$/m
  124. header __HAS_MSGID        MESSAGEID =~ /\S/
  125. header __MSGID_COMMENT        MESSAGEID =~ /\(.*\)/m
  126. meta INVALID_MSGID        __HAS_MSGID && !(__SANE_MSGID || __MSGID_COMMENT)
  127. describe INVALID_MSGID        Message-Id is not valid, according to RFC 2822
  128.  
  129. header __MOZILLA_MUA        X-Mailer =~ /\bMozilla\b/
  130. header __MOZILLA_MSGID        MESSAGEID =~ /^<[A-F\d]{8}\.[A-F1-9][A-F\d]{0,7}\@\S+>$/m
  131. meta FORGED_MUA_MOZILLA        (__MOZILLA_MUA && !__UNUSABLE_MSGID && !__MOZILLA_MSGID)
  132. describe FORGED_MUA_MOZILLA    Forged mail pretending to be from Mozilla
  133.  
  134. header __NMS_CGI_NOT_BUGGY      X-Mailer =~ /^NMS FormMail\.pl.*v\d/
  135. body __BUGGY_CGI        /Below is the result of your feedback form/
  136. meta BUGGY_CGI            __BUGGY_CGI && !__NMS_CGI_NOT_BUGGY
  137. describe BUGGY_CGI        Broken CGI script message
  138.  
  139.