Page 1 of 1
simple spamfilter with underscore doesn't work
Posted: Sun Jul 14, 2024 11:20 am
by CrazyCat
Hello there,
I've a little trouble with a spamfilter. The spammer can be detected with the following string:
Julia_nxde and he sometimes put spaces between letters.
So I initialy make a spamfilter on
*J*u*l*i*a*_*n*x*d*e*
Trouble: someone has triggered it by saying
J'ai mis les deux erreurs complètes dans le post, si jamais ça c/c une des deux, ils tomberont dessus.
And yes, all letters are in the sentence in the good order, but there is no underscore.
So, I thought I've to double the underscore, as it has to be done in the reason when you want to display one:
*J*u*l*i*a*__*n*x*d*e*
But a few hours after, he can come and spam.
So, do I have to use a regexp ? Or is there something I don't understand with underscore ?
Re: simple spamfilter with underscore doesn't work
Posted: Sun Jul 14, 2024 12:39 pm
by PeGaSuS
Hello,
So, I've added the following spamfilter on my network:
Code: Select all
/spamfilter add -simple cpnN block - Testing_simple_spamfilter_with_underscores *J*u*l*i*a*_*n*x*d*e*
and the IRCd returned:
Code: Select all
[14/07/2024 - 14:21:09] <irc.domain.tld> [info] Spamfilter added: '*J*u*l*i*a*_*n*x*d*e*' [type: simple] [targets: cpnN] [action: block] [reason: Testing simple spamfilter with underscores] [by: James!ubuntu@<redacted>]
This resulted on the following messages to be blocked:
Code: Select all
[14/07/2024 - 14:22:20] <irc.domain.tld> [info] [Spamfilter] PTirc_75!~Wockets@<redacted> matches filter '*J*u*l*i*a*_*n*x*d*e*': [cmd: PRIVMSG #spamtest: 'so, this is Julia_nxde'] [reason: Testing simple spamfilter with underscores] [action: block]
[14/07/2024 - 14:22:34] <irc.domain.tld> [info] [Spamfilter] PTirc_75!~Wockets@<redacted> matches filter '*J*u*l*i*a*_*n*x*d*e*': [cmd: PRIVMSG #spamtest: 'so, this is J u l i a _ n x d e'] [reason: Testing simple spamfilter with underscores] [action: block]
[14/07/2024 - 14:23:14] <irc.domain.tld> [info] [Spamfilter] PTirc_75!~Wockets@<redacted> matches filter '*J*u*l*i*a*_*n*x*d*e*': [cmd: PRIVMSG #spamtest: 'so, this is J-u-l-i-a-_-n-x-d-e'] [reason: Testing simple spamfilter with underscores] [action: block]
[14/07/2024 - 14:23:43] <irc.domain.tld> [info] [Spamfilter] PTirc_75!~Wockets@<redacted> matches filter '*J*u*l*i*a*_*n*x*d*e*': [cmd: PRIVMSG #spamtest: 'so, this is *J*u*l*i*a*_*n*x*d*e*'] [reason: Testing simple spamfilter with underscores] [action: block]
You can see a screenshot of the messages being blocked on my KiwiIRC instance
here
Re: simple spamfilter with underscore doesn't work
Posted: Sun Jul 14, 2024 12:53 pm
by CrazyCat
As said, my trouble is whith this detection:
tkl.SPAMFILTER_MATCH [info] [Spamfilter] Tibs!
[email protected] matches filter '*J*u*l*i*a*_*n*x*d*e*': [cmd: PRIVMSG #eggdrop: 'J'ai mis les deux erreurs complètes dans le post, si jamais ça c/c une des deux, ils tomberont dessus.'] [reason: No prostitution here] [action: report,gline]
There is no underscore in the sentence but it's detected...
Re: simple spamfilter with underscore doesn't work
Posted: Sun Jul 14, 2024 12:56 pm
by PeGaSuS
Right. I misunderstood the question.
Indeed, the sentence
J'ai mis les deux erreurs complètes dans le post, si jamais ça c/c une des deux, ils tomberont dessus.
does trigger the spamfilter even without underscore on it.
Re: simple spamfilter with underscore doesn't work
Posted: Sun Jul 14, 2024 1:22 pm
by Syzop
It seems match_simple() also makes _ special, similar to match_esc(). I don't think that is intended and more like a copy-paste error in the source code (between the functions). I would have to look into the history to really be sure, though
Re: simple spamfilter with underscore doesn't work
Posted: Sun Jul 14, 2024 1:30 pm
by CrazyCat
Thanks Syzop
I'd proposed PR #290 (just removed the exception on _)
Re: simple spamfilter with underscore doesn't work
Posted: Sun Jul 14, 2024 4:09 pm
by Syzop
I see this is the case for 15+ years now so.. hmm I think this needs a bit more careful checking (match_simple is used from more than 110 places). Don't want to do it post-rc1 anyway. Filed as
https://bugs.unrealircd.org/view.php?id=6431
I suggest to use regex for now if you really only want to match underscore only. Thanks for bringing it up!
Re: simple spamfilter with underscore doesn't work
Posted: Sun Jul 14, 2024 4:14 pm
by CrazyCat
Are regex case-insensitive or must I add (?i) at the start of it ?
Re: simple spamfilter with underscore doesn't work
Posted: Sun Jul 14, 2024 4:16 pm
by Syzop
They are case insensitive by default, yeah, in UnrealIRCd anyway...
Re: simple spamfilter with underscore doesn't work
Posted: Sun Jul 14, 2024 4:19 pm
by CrazyCat
Ok, thanx
