simple spamfilter with underscore doesn't work

If you have trouble on your server with spam, drones/zombies/bots or proxies

Moderator: Supporters

Post Reply
CrazyCat
Posts: 241
Joined: Thu Apr 28, 2005 1:05 pm
Location: France
Contact:

simple spamfilter with underscore doesn't work

Post by CrazyCat »

Hello there,
I've a little trouble with a spamfilter. The spammer can be detected with the following string: Julia_nxde and he sometimes put spaces between letters.
So I initialy make a spamfilter on *J*u*l*i*a*_*n*x*d*e*
Trouble: someone has triggered it by saying
J'ai mis les deux erreurs complètes dans le post, si jamais ça c/c une des deux, ils tomberont dessus.
And yes, all letters are in the sentence in the good order, but there is no underscore.

So, I thought I've to double the underscore, as it has to be done in the reason when you want to display one: *J*u*l*i*a*__*n*x*d*e*
But a few hours after, he can come and spam.

So, do I have to use a regexp ? Or is there something I don't understand with underscore ?
PeGaSuS
Official supporter
Posts: 108
Joined: Tue Jun 27, 2017 4:42 pm
Contact:

Re: simple spamfilter with underscore doesn't work

Post by PeGaSuS »

Hello,

So, I've added the following spamfilter on my network:

Code: Select all

/spamfilter add -simple cpnN block - Testing_simple_spamfilter_with_underscores *J*u*l*i*a*_*n*x*d*e*
and the IRCd returned:

Code: Select all

[14/07/2024 - 14:21:09] <irc.domain.tld> [info] Spamfilter added: '*J*u*l*i*a*_*n*x*d*e*' [type: simple] [targets: cpnN] [action: block] [reason: Testing simple spamfilter with underscores] [by: James!ubuntu@<redacted>]
This resulted on the following messages to be blocked:

Code: Select all

[14/07/2024 - 14:22:20] <irc.domain.tld> [info] [Spamfilter] PTirc_75!~Wockets@<redacted> matches filter '*J*u*l*i*a*_*n*x*d*e*': [cmd: PRIVMSG #spamtest: 'so, this is Julia_nxde'] [reason: Testing simple spamfilter with underscores] [action: block]
[14/07/2024 - 14:22:34] <irc.domain.tld> [info] [Spamfilter] PTirc_75!~Wockets@<redacted> matches filter '*J*u*l*i*a*_*n*x*d*e*': [cmd: PRIVMSG #spamtest: 'so, this is J u l i a _ n x d e'] [reason: Testing simple spamfilter with underscores] [action: block]
[14/07/2024 - 14:23:14] <irc.domain.tld> [info] [Spamfilter] PTirc_75!~Wockets@<redacted> matches filter '*J*u*l*i*a*_*n*x*d*e*': [cmd: PRIVMSG #spamtest: 'so, this is J-u-l-i-a-_-n-x-d-e'] [reason: Testing simple spamfilter with underscores] [action: block]
[14/07/2024 - 14:23:43] <irc.domain.tld> [info] [Spamfilter] PTirc_75!~Wockets@<redacted> matches filter '*J*u*l*i*a*_*n*x*d*e*': [cmd: PRIVMSG #spamtest: 'so, this is *J*u*l*i*a*_*n*x*d*e*'] [reason: Testing simple spamfilter with underscores] [action: block]
You can see a screenshot of the messages being blocked on my KiwiIRC instance here
IRC Network: PTirc - GitHub: TehPeGaSuS - Help and support: #unreal-support
CrazyCat
Posts: 241
Joined: Thu Apr 28, 2005 1:05 pm
Location: France
Contact:

Re: simple spamfilter with underscore doesn't work

Post by CrazyCat »

As said, my trouble is whith this detection:
tkl.SPAMFILTER_MATCH [info] [Spamfilter] Tibs![email protected] matches filter '*J*u*l*i*a*_*n*x*d*e*': [cmd: PRIVMSG #eggdrop: 'J'ai mis les deux erreurs complètes dans le post, si jamais ça c/c une des deux, ils tomberont dessus.'] [reason: No prostitution here] [action: report,gline]
There is no underscore in the sentence but it's detected...
PeGaSuS
Official supporter
Posts: 108
Joined: Tue Jun 27, 2017 4:42 pm
Contact:

Re: simple spamfilter with underscore doesn't work

Post by PeGaSuS »

Right. I misunderstood the question.
Indeed, the sentence
J'ai mis les deux erreurs complètes dans le post, si jamais ça c/c une des deux, ils tomberont dessus.
does trigger the spamfilter even without underscore on it.
IRC Network: PTirc - GitHub: TehPeGaSuS - Help and support: #unreal-support
Syzop
UnrealIRCd head coder
Posts: 2140
Joined: Sat Mar 06, 2004 8:57 pm
Location: .nl
Contact:

Re: simple spamfilter with underscore doesn't work

Post by Syzop »

It seems match_simple() also makes _ special, similar to match_esc(). I don't think that is intended and more like a copy-paste error in the source code (between the functions). I would have to look into the history to really be sure, though :)
CrazyCat
Posts: 241
Joined: Thu Apr 28, 2005 1:05 pm
Location: France
Contact:

Re: simple spamfilter with underscore doesn't work

Post by CrazyCat »

Thanks Syzop :)

I'd proposed PR #290 (just removed the exception on _)
Syzop
UnrealIRCd head coder
Posts: 2140
Joined: Sat Mar 06, 2004 8:57 pm
Location: .nl
Contact:

Re: simple spamfilter with underscore doesn't work

Post by Syzop »

I see this is the case for 15+ years now so.. hmm I think this needs a bit more careful checking (match_simple is used from more than 110 places). Don't want to do it post-rc1 anyway. Filed as https://bugs.unrealircd.org/view.php?id=6431

I suggest to use regex for now if you really only want to match underscore only. Thanks for bringing it up!
CrazyCat
Posts: 241
Joined: Thu Apr 28, 2005 1:05 pm
Location: France
Contact:

Re: simple spamfilter with underscore doesn't work

Post by CrazyCat »

Are regex case-insensitive or must I add (?i) at the start of it ?
Syzop
UnrealIRCd head coder
Posts: 2140
Joined: Sat Mar 06, 2004 8:57 pm
Location: .nl
Contact:

Re: simple spamfilter with underscore doesn't work

Post by Syzop »

They are case insensitive by default, yeah, in UnrealIRCd anyway...
CrazyCat
Posts: 241
Joined: Thu Apr 28, 2005 1:05 pm
Location: France
Contact:

Re: simple spamfilter with underscore doesn't work

Post by CrazyCat »

Ok, thanx
Post Reply