local.sco

flex是linux下一个很有用的高效的编译器工具

header FROM_LOCAL_HEX		From =~ /[0-9a-f]{11}\S*\@/i
describe FROM_LOCAL_HEX		From: localpart has long hexadecimal sequence

header FROM_LOCAL_DIGITS	From =~ /\d{11}\S*\@/i
describe FROM_LOCAL_DIGITS	From: localpart has long digit sequence

header X_MAILER_SPAM		X-Mailer !~ m{[A-Z0-9./]} [if-unset: Foo 1.0]
describe X_MAILER_SPAM		X-Mailer: header is bulk email fingerprint

header X_PRIORITY_CC		ALL =~ /\nX-Priority:[^\n]{0,80}\nCc:/si
describe X_PRIORITY_CC		Cc: after X-Priority: (bulk email fingerprint)

header    SUBJ_CONSONANTS       Subject =~ /\b[bcghjklmnpqrstvwxz]{6,20}\b/
describe  SUBJ_CONSONANTS       Subject contains consecutive consonants in "word"

header BAD_ENC_HEADER		ALL =~ /=\?[^?\s]+\?[^?\s]\?\s*[^?]+\s(?!\?=)/
describe BAD_ENC_HEADER		Message has bad MIME encoding in the header

#********************************************************************************
# 7. HTML tests --> 20_html_tests.cf
#********************************************************************************

# HTML control test, HTML spam rules should all have better S/O than this
body HTML_MESSAGE		eval:html_test('html')
describe HTML_MESSAGE		HTML included in message

# the HTML percentage range
# should really be converted into a numeric function test
body HTML_00_10			eval:html_range('ratio','0.00','0.10')
describe HTML_00_10		Message is 0% to 10% HTML

body HTML_10_20			eval:html_range('ratio','0.10','0.20')
describe HTML_10_20		Message is 10% to 20% HTML

body HTML_20_30			eval:html_range('ratio','0.20','0.30')
describe HTML_20_30		Message is 20% to 30% HTML

body HTML_30_40			eval:html_range('ratio','0.30','0.40')
describe HTML_30_40		Message is 30% to 40% HTML

body HTML_40_50			eval:html_range('ratio','0.40','0.50')
describe HTML_40_50		Message is 40% to 50% HTML

body HTML_50_60			eval:html_range('ratio','0.50','0.60')
describe HTML_50_60		Message is 50% to 60% HTML

body HTML_60_70			eval:html_range('ratio','0.60','0.70')
describe HTML_60_70		Message is 60% to 70% HTML

body HTML_70_80			eval:html_range('ratio','0.70','0.80')
describe HTML_70_80		Message is 70% to 80% HTML

body HTML_80_90			eval:html_range('ratio','0.80','0.90')
describe HTML_80_90		Message is 80% to 90% HTML

body HTML_90_100		eval:html_range('ratio','0.90','1.00')
describe HTML_90_100		Message is 90% to 100% HTML

# HTML shouting range
# should really be converted into a numeric function test
body HTML_SHOUTING3		eval:html_range('max_shouting','2','3')
describe HTML_SHOUTING3		HTML has very strong "shouting" markup

body HTML_SHOUTING4		eval:html_range('max_shouting','3','4')
describe HTML_SHOUTING4		HTML has very strong "shouting" markup

body HTML_SHOUTING5		eval:html_range('max_shouting','4','5')
describe HTML_SHOUTING5		HTML has very strong "shouting" markup

body HTML_SHOUTING6		eval:html_range('max_shouting','5','6')
describe HTML_SHOUTING6		HTML has very strong "shouting" markup

body HTML_SHOUTING7		eval:html_range('max_shouting','6','7')
describe HTML_SHOUTING7		HTML has very strong "shouting" markup

body HTML_TEXT_AFTER_HTML	eval:html_test('text_after_html')
describe HTML_TEXT_AFTER_HTML	HTML contains text after HTML close tag

body HTML_TEXT_AFTER_BODY	eval:html_test('text_after_body')
describe HTML_TEXT_AFTER_BODY	HTML contains text after BODY close tag

# HTML comment tests
body HTML_COMMENT_SHORT		eval:html_text_match('comment', '<!(?!-).{0,6}>')
describe HTML_COMMENT_SHORT	HTML comment is very short

body HTML_COMMENT_SAVED_URL	eval:html_text_match('comment', '<!-- saved from url=\(\d{4}\)')
describe HTML_COMMENT_SAVED_URL	HTML message is a saved web page

body HTML_EMBEDS		eval:html_test('embeds')
describe HTML_EMBEDS		HTML with embedded plugin object

body HTML_EVENT_UNSAFE		eval:html_test('html_event_unsafe')
describe HTML_EVENT_UNSAFE	HTML contains unsafe auto-executing code

body HTML_EXTRA_CLOSE		eval:html_range('closed_extra_ratio', '0.09', 'inf')
describe HTML_EXTRA_CLOSE	HTML contains far too many close tags

body HTML_FONT_SIZE_TINY	eval:html_eval('min_size', '< 1')
describe HTML_FONT_SIZE_TINY	HTML font size is tiny

body HTML_FONT_SIZE_NONE	eval:html_eval('min_size', '< 0')
describe HTML_FONT_SIZE_NONE	HTML font size is negative

body HTML_FONT_SIZE_LARGE	eval:html_range('max_size', '5', '6')
describe HTML_FONT_SIZE_LARGE	HTML font size is large

body HTML_FONT_SIZE_HUGE	eval:html_range('max_size', '6', 'inf')
describe HTML_FONT_SIZE_HUGE	HTML font size is huge

body HTML_FONT_BIG		eval:html_test('big_font')
describe HTML_FONT_BIG		HTML tag for a big font size

body HTML_FONT_TINY		eval:html_test('tiny_font')
describe HTML_FONT_TINY		HTML tag for a tiny font size

body HTML_FONT_INVISIBLE	eval:html_test('font_invisible')
describe HTML_FONT_INVISIBLE	HTML font color is same as background

body HTML_FONT_LOW_CONTRAST	eval:html_test('font_low_contrast')
describe HTML_FONT_LOW_CONTRAST	HTML font color similar to background

body HTML_FONT_FACE_BAD		eval:html_test('font_face_bad')
describe HTML_FONT_FACE_BAD	HTML font face is not a word

body HTML_FONT_FACE_CAPS	eval:html_test('font_face_caps')
describe HTML_FONT_FACE_CAPS	HTML font face has excess capital characters

body HTML_FORMACTION_MAILTO	eval:html_test('form_action_mailto')
describe HTML_FORMACTION_MAILTO	HTML includes a form which sends mail

# HTML_IMAGE_ONLY - not much raw HTML with images (absolute)
body HTML_IMAGE_ONLY_04		eval:html_image_only('0000','0400')
describe HTML_IMAGE_ONLY_04	HTML: images with 0-400 bytes of words

body HTML_IMAGE_ONLY_08		eval:html_image_only('0400','0800')
describe HTML_IMAGE_ONLY_08	HTML: images with 400-800 bytes of words

body HTML_IMAGE_ONLY_12		eval:html_image_only('0800','1200')
describe HTML_IMAGE_ONLY_12	HTML: images with 800-1200 bytes of words

body HTML_IMAGE_ONLY_16		eval:html_image_only('1200','1600')
describe HTML_IMAGE_ONLY_16	HTML: images with 1200-1600 bytes of words

body HTML_IMAGE_ONLY_20		eval:html_image_only('1600','2000')
describe HTML_IMAGE_ONLY_20	HTML: images with 1600-2000 bytes of words

body HTML_IMAGE_ONLY_24		eval:html_image_only('2000','2400')
describe HTML_IMAGE_ONLY_24	HTML: images with 2000-2400 bytes of words

body HTML_IMAGE_ONLY_28		eval:html_image_only('2400','2800')
describe HTML_IMAGE_ONLY_28	HTML: images with 2400-2800 bytes of words

body HTML_IMAGE_ONLY_32		eval:html_image_only('2800','3200')
describe HTML_IMAGE_ONLY_32	HTML: images with 2800-3200 bytes of words

# HTML_IMAGE_RATIO - more image area than text (ratio)
body HTML_IMAGE_RATIO_02	eval:html_image_ratio('0.000','0.002')
describe HTML_IMAGE_RATIO_02	HTML has a low ratio of text to image area

body HTML_IMAGE_RATIO_04	eval:html_image_ratio('0.002','0.004')
describe HTML_IMAGE_RATIO_04	HTML has a low ratio of text to image area

body HTML_IMAGE_RATIO_06	eval:html_image_ratio('0.004','0.006')
describe HTML_IMAGE_RATIO_06	HTML has a low ratio of text to image area

body HTML_IMAGE_RATIO_08	eval:html_image_ratio('0.006','0.008')
describe HTML_IMAGE_RATIO_08	HTML has a low ratio of text to image area

body HTML_LINK_IMAGE_BUG	eval:html_test('anchor_image_bug')
describe HTML_LINK_IMAGE_BUG	HTML link plus image plus web bug

body HTML_LINK_PUSH_HERE	eval:html_text_match('anchor', '(?i)(?:push|go|cl[1l]ck)\s*(?:here|this)')
describe HTML_LINK_PUSH_HERE	HTML link text says "push here" or similar

body HTML_LINK_OPT_OUT		eval:html_text_match('anchor', '(?i)opt.?out')
describe HTML_LINK_OPT_OUT	HTML link text says "opt out" or similar

# HTML obfuscation
body HTML_OBFUSCATE_05_10	eval:html_range('obfuscation_ratio','.05','.1')
describe HTML_OBFUSCATE_05_10	Message is 5% to 10% HTML obfuscation

body HTML_OBFUSCATE_10_20	eval:html_range('obfuscation_ratio','.1','.2')
describe HTML_OBFUSCATE_10_20	Message is 10% to 20% HTML obfuscation

body HTML_OBFUSCATE_20_30	eval:html_range('obfuscation_ratio','.2','.3')
describe HTML_OBFUSCATE_20_30	Message is 20% to 30% HTML obfuscation

body HTML_OBFUSCATE_30_40	eval:html_range('obfuscation_ratio','.3','.4')
describe HTML_OBFUSCATE_30_40	Message is 30% to 40% HTML obfuscation

body HTML_OBFUSCATE_40_50	eval:html_range('obfuscation_ratio','.4','.5')
describe HTML_OBFUSCATE_40_50	Message is 40% to 50% HTML obfuscation

body HTML_OBFUSCATE_50_60	eval:html_range('obfuscation_ratio','.5','.6')
describe HTML_OBFUSCATE_50_60	Message is 50% to 60% HTML obfuscation

body HTML_OBFUSCATE_60_70	eval:html_range('obfuscation_ratio','.6','.7')
describe HTML_OBFUSCATE_60_70	Message is 60% to 70% HTML obfuscation

body HTML_OBFUSCATE_70_80	eval:html_range('obfuscation_ratio','.7','.8')
describe HTML_OBFUSCATE_70_80	Message is 70% to 80% HTML obfuscation

body HTML_OBFUSCATE_80_90	eval:html_range('obfuscation_ratio','.8','.9')
describe HTML_OBFUSCATE_80_90	Message is 80% to 90% HTML obfuscation

body HTML_OBFUSCATE_90_100	eval:html_range('obfuscation_ratio','.9','1.0')
describe HTML_OBFUSCATE_90_100	Message is 90% to 100% HTML obfuscation

# backhair - idea from backhair set by Jennifer Wheeler and Adam Lopresto.
body HTML_BACKHAIR_2		eval:html_range('backhair_count', '1', '4')
describe HTML_BACKHAIR_2	HTML tags used to obfuscate words

body HTML_BACKHAIR_4		eval:html_range('backhair_count', '4', '8')
describe HTML_BACKHAIR_4	HTML tags used to obfuscate words

body HTML_BACKHAIR_8		eval:html_range('backhair_count', '8', 'inf')
describe HTML_BACKHAIR_8	HTML tags used to obfuscate words

# HTML attribute testing
body HTML_ATTR_BAD		eval:html_range('attr_bad','0.75','1.0')
describe HTML_ATTR_BAD		HTML has many bad attributes in tags

body HTML_ATTR_UNIQUE		eval:html_range('attr_unique_bad','0.5','1.0')
describe HTML_ATTR_UNIQUE	HTML appears to have random attributes in tags

body HTML_WEB_BUGS		eval:html_test('web_bugs')
describe HTML_WEB_BUGS		Image tag intended to identify you

body HTML_TAG_BALANCE_BODY	eval:html_tag_balance('body', '!= 0')
describe HTML_TAG_BALANCE_BODY	HTML has unbalanced "body" tags

body HTML_TAG_BALANCE_HEAD	eval:html_tag_balance('head', '!= 0')
describe HTML_TAG_BALANCE_HEAD	HTML has unbalanced "head" tags

body HTML_TAG_EXIST_BGSOUND	eval:html_tag_exists('bgsound')
describe HTML_TAG_EXIST_BGSOUND	HTML has "bgsound" tag

body HTML_TAG_EXIST_MARQUEE	eval:html_tag_exists('marquee')
describe HTML_TAG_EXIST_MARQUEE	HTML has "marquee" tag

body HTML_TAG_EXIST_TBODY	eval:html_tag_exists('tbody')
describe HTML_TAG_EXIST_TBODY	HTML has "tbody" tag

# percentage of tags that are not legal elements in HTML
body HTML_BADTAG_00_10	eval:html_range('bad_tag_ratio','0.00','0.10')
describe HTML_BADTAG_00_10	HTML message is 0% to 10% bad tags

body HTML_BADTAG_10_20	eval:html_range('bad_tag_ratio','0.10','0.20')
describe HTML_BADTAG_10_20	HTML message is 10% to 20% bad tags

body HTML_BADTAG_20_30	eval:html_range('bad_tag_ratio','0.20','0.30')
describe HTML_BADTAG_20_30	HTML message is 20% to 30% bad tags

body HTML_BADTAG_30_40	eval:html_range('bad_tag_ratio','0.30','0.40')
describe HTML_BADTAG_30_40	HTML message is 30% to 40% bad tags

body HTML_BADTAG_40_50	eval:html_range('bad_tag_ratio','0.40','0.50')
describe HTML_BADTAG_40_50	HTML message is 40% to 50% bad tags

body HTML_BADTAG_50_60	eval:html_range('bad_tag_ratio','0.50','0.60')
describe HTML_BADTAG_50_60	HTML message is 50% to 60% bad tags

body HTML_BADTAG_60_70	eval:html_range('bad_tag_ratio','0.60','0.70')
describe HTML_BADTAG_60_70	HTML message is 60% to 70% bad tags

body HTML_BADTAG_70_80	eval:html_range('bad_tag_ratio','0.70','0.80')
describe HTML_BADTAG_70_80	HTML message is 70% to 80% bad tags

body HTML_BADTAG_80_90	eval:html_range('bad_tag_ratio','0.80','0.90')
describe HTML_BADTAG_80_90	HTML message is 80% to 90% bad tags

body HTML_BADTAG_90_100	eval:html_range('bad_tag_ratio','0.90','1.00')
describe HTML_BADTAG_90_100	HTML message is 90% to 100% bad tags

# percentage of unique non-elements in HTML
body HTML_NONELEMENT_00_10	eval:html_range('non_element_ratio','0.00','0.10')
describe HTML_NONELEMENT_00_10	0% to 10% of HTML elements are non-standard

body HTML_NONELEMENT_10_20	eval:html_range('non_element_ratio','0.10','0.20')
describe HTML_NONELEMENT_10_20	10% to 20% of HTML elements are non-standard

body HTML_NONELEMENT_20_30	eval:html_range('non_element_ratio','0.20','0.30')
describe HTML_NONELEMENT_20_30	20% to 30% of HTML elements are non-standard