Exclude MIME_BAD_UNICODE false positive (#5030)

* Update composites.conf

* Update composites.conf

* Update composites.conf

* Update composites.conf

* Update mime_types_group.conf

* Update mime_types_group.conf

* Update composites.conf

diff --git a/conf/composites.conf b/conf/composites.conf
index b1bff1c1a8baea7dd797212bb55637bea23fd06f..4fb97588f9d118c3bd278f5d2cd9acbf395aca05 100644 (file)
--- a/conf/composites.conf
+++ b/conf/composites.conf
@@ -203,6 +203,18 @@ composites {
     policy = "leave";
     description = "Message contains redirector, anonymous or IPFS gateway URL and is marked by fuzzy/bayes/SURBL/RBL";
   }
+  MIME_BAD_EXT_IN_OBFUSCATED_ARCHIVE {
+    expression = "MIME_BAD_EXTENSION and MIME_OBFUSCATED_ARCHIVE";
+    score = 8.0;
+    policy = leave;
+    description = "Attachment with bad extension and archive that has filename with clear obfuscation signs";
+  }
+  MIME_BAD_EXT_WITH_BAD_UNICODE {
+    expression = "MIME_BAD_EXTENSION and MIME_BAD_UNICODE";
+    score = 8.0;
+    policy = leave;
+    description = "Attachment with bad extension and filename that has known obscured unicode characters";
+  }
 
   .include(try=true; priority=1; duplicate=merge) "$LOCAL_CONFDIR/local.d/composites.conf"
   .include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/composites.conf"

diff --git a/conf/scores.d/mime_types_group.conf b/conf/scores.d/mime_types_group.conf
index 268709ee91c6b2dd200d41e49c3bd69593501614..13778fe9175f32586abd151566da9b93f89c9c5b 100644 (file)
--- a/conf/scores.d/mime_types_group.conf
+++ b/conf/scores.d/mime_types_group.conf
@@ -46,7 +46,7 @@ symbols = {
         one_shot = true;
     }
     "MIME_OBFUSCATED_ARCHIVE" {
-        weight = 8.0;
+        weight = 2.0;
         description = "Archive has files with clear obfuscation signs";
         one_shot = true;
     }
@@ -71,7 +71,7 @@ symbols = {
         one_shot = true;
     }
     "MIME_BAD_UNICODE" {
-        weight = 8.0;
+        weight = 2.0;
         description = "Filename with known obscured unicode characters";
         one_shot = true;
     }