simple spamfilter with underscore doesn't work

[CrazyCat]

Hello there,
I've a little trouble with a spamfilter. The spammer can be detected with the following string: Julia_nxde and he sometimes put spaces between letters.
So I initialy make a spamfilter on *J*u*l*i*a*_*n*x*d*e*
Trouble: someone has triggered it by saying

J'ai mis les deux erreurs complètes dans le post, si jamais ça c/c une des deux, ils tomberont dessus.

And yes, all letters are in the sentence in the good order, but there is no underscore.

So, I thought I've to double the underscore, as it has to be done in the reason when you want to display one: *J*u*l*i*a*__*n*x*d*e*
But a few hours after, he can come and spam.

So, do I have to use a regexp ? Or is there something I don't understand with underscore ?

[PeGaSuS]

Hello,

So, I've added the following spamfilter on my network:

Code: Select all

/spamfilter add -simple cpnN block - Testing_simple_spamfilter_with_underscores *J*u*l*i*a*_*n*x*d*e*

and the IRCd returned:

Code: Select all

[14/07/2024 - 14:21:09] <irc.domain.tld> [info] Spamfilter added: '*J*u*l*i*a*_*n*x*d*e*' [type: simple] [targets: cpnN] [action: block] [reason: Testing simple spamfilter with underscores] [by: James!ubuntu@<redacted>]

This resulted on the following messages to be blocked:

Code: Select all

[14/07/2024 - 14:22:20] <irc.domain.tld> [info] [Spamfilter] PTirc_75!~Wockets@<redacted> matches filter '*J*u*l*i*a*_*n*x*d*e*': [cmd: PRIVMSG #spamtest: 'so, this is Julia_nxde'] [reason: Testing simple spamfilter with underscores] [action: block]
[14/07/2024 - 14:22:34] <irc.domain.tld> [info] [Spamfilter] PTirc_75!~Wockets@<redacted> matches filter '*J*u*l*i*a*_*n*x*d*e*': [cmd: PRIVMSG #spamtest: 'so, this is J u l i a _ n x d e'] [reason: Testing simple spamfilter with underscores] [action: block]
[14/07/2024 - 14:23:14] <irc.domain.tld> [info] [Spamfilter] PTirc_75!~Wockets@<redacted> matches filter '*J*u*l*i*a*_*n*x*d*e*': [cmd: PRIVMSG #spamtest: 'so, this is J-u-l-i-a-_-n-x-d-e'] [reason: Testing simple spamfilter with underscores] [action: block]
[14/07/2024 - 14:23:43] <irc.domain.tld> [info] [Spamfilter] PTirc_75!~Wockets@<redacted> matches filter '*J*u*l*i*a*_*n*x*d*e*': [cmd: PRIVMSG #spamtest: 'so, this is *J*u*l*i*a*_*n*x*d*e*'] [reason: Testing simple spamfilter with underscores] [action: block]

You can see a screenshot of the messages being blocked on my KiwiIRC instance here

[CrazyCat]

As said, my trouble is whith this detection:

tkl.SPAMFILTER_MATCH [info] [Spamfilter] Tibs![email protected] matches filter '*J*u*l*i*a*_*n*x*d*e*': [cmd: PRIVMSG #eggdrop: 'J'ai mis les deux erreurs complètes dans le post, si jamais ça c/c une des deux, ils tomberont dessus.'] [reason: No prostitution here] [action: report,gline]

There is no underscore in the sentence but it's detected...

[PeGaSuS]

Right. I misunderstood the question.
Indeed, the sentence

J'ai mis les deux erreurs complètes dans le post, si jamais ça c/c une des deux, ils tomberont dessus.

does trigger the spamfilter even without underscore on it.

[Syzop]

It seems match_simple() also makes _ special, similar to match_esc(). I don't think that is intended and more like a copy-paste error in the source code (between the functions). I would have to look into the history to really be sure, though

[CrazyCat]

Thanks Syzop

I'd proposed PR #290 (just removed the exception on _)

[Syzop]

I see this is the case for 15+ years now so.. hmm I think this needs a bit more careful checking (match_simple is used from more than 110 places). Don't want to do it post-rc1 anyway. Filed as https://bugs.unrealircd.org/view.php?id=6431

I suggest to use regex for now if you really only want to match underscore only. Thanks for bringing it up!

[CrazyCat]

Are regex case-insensitive or must I add (?i) at the start of it ?

[Syzop]

They are case insensitive by default, yeah, in UnrealIRCd anyway...

[CrazyCat]

Ok, thanx