From: Vsevolod Stakhov <vsevolod@highsecure.ru>
Date: Fri, 12 Apr 2019 11:35:23 +0000 (+0100)
Subject: [Rules] Add additional conditions to perform BTC checks
X-Git-Tag: 1.9.2~30
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4e79bc05da66ad3e29c80b0e7220537bab3d5ae4;p=thirdparty%2Frspamd.git

[Rules] Add additional conditions to perform BTC checks
---

diff --git a/rules/regexp/misc.lua b/rules/regexp/misc.lua
index 2076c78faa..ece856c963 100644
--- a/rules/regexp/misc.lua
+++ b/rules/regexp/misc.lua
@@ -68,11 +68,12 @@ local password_in_words = [[/^pass(?:(?:word)|(?:phrase))$/i{words}]]
 local btc_wallet_address = [[/^[13][1-9A-Za-z]{25,34}$/]]
 local wallet_word = [[/^wallet$/{words}]]
 local broken_unicode = [[has_flag(bad_unicode)]]
+local list_unsub = [[header_exists(List-Unsubscribe)]]
 
 reconf['LEAKED_PASSWORD_SCAM'] = {
-  re = string.format('%s{words} & (%s | %s | %s | %s | %s | %s | lua:check_data_images)',
+  re = string.format('%s{words} & (%s | %s | %s | %s | %s | %s | %s | lua:check_data_images)',
       btc_wallet_address, password_in_words, wallet_word,
-      my_victim, your_webcam, your_onan, broken_unicode),
+      my_victim, your_webcam, your_onan, broken_unicode, list_unsub),
   description = 'Contains password word and BTC wallet address',
   functions = {
     check_data_images = function(task)