Return-Path: Delivered-To: apmail-spamassassin-users-archive@www.apache.org Received: (qmail 82026 invoked from network); 8 Mar 2010 21:58:14 -0000 Received: from unknown (HELO mail.apache.org) (140.211.11.3) by 140.211.11.9 with SMTP; 8 Mar 2010 21:58:14 -0000 Received: (qmail 99374 invoked by uid 500); 8 Mar 2010 21:57:46 -0000 Delivered-To: apmail-spamassassin-users-archive@spamassassin.apache.org Received: (qmail 99284 invoked by uid 500); 8 Mar 2010 21:57:46 -0000 Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm Precedence: bulk list-help: list-unsubscribe: List-Post: List-Id: Delivered-To: mailing list users@spamassassin.apache.org Received: (qmail 99277 invoked by uid 99); 8 Mar 2010 21:57:46 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 08 Mar 2010 21:57:46 +0000 X-ASF-Spam-Status: No, hits=-0.0 required=10.0 tests=SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: local policy) Received: from [195.137.4.79] (HELO quad.pendre.co.uk) (195.137.4.79) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 08 Mar 2010 21:57:45 +0000 Received: from localhost (Quad [127.0.0.1]) by quad.pendre.co.uk (Postfix) with ESMTP id 87294262006F for ; Mon, 8 Mar 2010 21:57:23 +0000 (GMT) X-Virus-Scanned: amavisd-new at pendre.co.uk Received: from quad.pendre.co.uk ([127.0.0.1]) by localhost (quad.pendre.co.uk [127.0.0.1]) (amavisd-new, port 10024) with LMTP id CmCTM1dYO2xt; Mon, 8 Mar 2010 21:57:23 +0000 (GMT) Received: from [192.168.0.1] (pendre.co.uk [192.168.0.1]) by quad.pendre.co.uk (Postfix) with ESMTP id 4CE74262003C for ; Mon, 8 Mar 2010 21:57:23 +0000 (GMT) Message-ID: <4B9572C3.2070304@unixmail.co.uk> Date: Mon, 08 Mar 2010 21:57:23 +0000 From: Ned Slider User-Agent: Thunderbird 2.0.0.23 (X11/20090812) MIME-Version: 1.0 To: Spamassassin Mailing List Subject: Re: Hidden Dir in URI (Was: FreeMail plugin updated - banks) References: <20090510100828.GA8463@posti.hege.li> <4A06B765.6020708@unixmail.co.uk> <41381.RkEUX0YQVF0=.1241956948.squirrel@mail.junc.org> <4A06D966.2080404@perkel.com> <4A07E59B.90602@lists.grepular.com> <4A0A1115.8000309@unixmail.co.uk> <4A0D5597.1000107@bristol.ac.uk> <4A0D92FD.9020907@unixmail.co.uk> <4A0DA706.8050002@khopis.com> <4A0DB339.5000501@unixmail.co.uk> <4A0DB877.6040906@khopis.com> <507E90FA-D48B-4D92-AF02-53BD1B108592@kreme.com> <2EF261DD-A389-4C09-8905-488CCE3F9B19@kreme.com> <4A0DE014.2000007@khopis.com> <4B9513C6.3070906@unixmail.co.uk> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit John Hardin wrote: > On Mon, 8 Mar 2010, Ned Slider wrote: >> >> So I've refined the rule to specifically exclude hitting on the >> sequence ../. which stops the rule triggering on multiple relative paths. >> >> uri LOCAL_URI_HIDDEN_DIR /(?!.{6}\.\.\/\..).{8}\/\../ > > How about: > > uri LOCAL_URI_HIDDEN_DIR m;.{8}/\..(?!/); > Yes, that works too on my examples and is probably a more elegant solution than mine :-) John - are you able to try this rule in your sandbox and do mass checks? I'd be interested to see how it scores.