From: Vsevolod Stakhov Date: Sat, 4 Oct 2025 18:41:25 +0000 (+0100) Subject: [Minor] Fix luacheck warnings in HTML fuzzy Lua modules X-Git-Tag: 3.14.0~87^2~18 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=719c1fec4276fd3a7694a3127e3d2ab33a42fd3c;p=thirdparty%2Frspamd.git [Minor] Fix luacheck warnings in HTML fuzzy Lua modules - Remove unused variables (rspamd_logger, text_matches, etc.) - Remove trailing whitespace - Fix unused return value from register_symbol --- diff --git a/lualib/lua_fuzzy_html.lua b/lualib/lua_fuzzy_html.lua index 1b3b36cd9f..ca0ad0f2b2 100644 --- a/lualib/lua_fuzzy_html.lua +++ b/lualib/lua_fuzzy_html.lua @@ -9,7 +9,6 @@ but CTA (Call-To-Action) domains are different. ]] local exports = {} -local rspamd_logger = require "rspamd_logger" local lua_util = require "lua_util" --[[ @@ -23,7 +22,7 @@ Returns: phishing_score, explanation exports.check_html_text_mismatch = function(task, fuzzy_results) local html_matches = {} local text_matches = {} - + -- Separate HTML and text fuzzy matches for _, res in ipairs(fuzzy_results or {}) do if res.type == 'html' then @@ -32,7 +31,7 @@ exports.check_html_text_mismatch = function(task, fuzzy_results) table.insert(text_matches, res) end end - + -- Phishing scenario: high text match but low/no HTML match if #text_matches > 0 and #html_matches == 0 then local max_text_score = 0 @@ -41,7 +40,7 @@ exports.check_html_text_mismatch = function(task, fuzzy_results) max_text_score = res.score end end - + -- High text match but no HTML match = suspicious if max_text_score > 0.7 then return max_text_score * 0.5, string.format( @@ -49,7 +48,7 @@ exports.check_html_text_mismatch = function(task, fuzzy_results) max_text_score) end end - + -- Inverse scenario: HTML match but no text match -- (Could be template with varying content - less suspicious) if #html_matches > 0 and #text_matches == 0 then @@ -59,13 +58,13 @@ exports.check_html_text_mismatch = function(task, fuzzy_results) max_html_score = res.score end end - + -- This is expected for newsletters/notifications lua_util.debugm('fuzzy_html', task, 'HTML match (%.2f) without text match - likely template variation', max_html_score) end - + return 0, nil end @@ -81,7 +80,7 @@ exports.check_brand_hijack = function(task, html_fuzzy_result, text_fuzzy_result if not html_fuzzy_result then return 0, nil end - + -- High HTML match = known template if html_fuzzy_result.score > 0.8 then -- Check if text is suspicious @@ -91,7 +90,7 @@ exports.check_brand_hijack = function(task, html_fuzzy_result, text_fuzzy_result html_fuzzy_result.score) end end - + return 0, nil end diff --git a/rules/fuzzy_html_phishing.lua b/rules/fuzzy_html_phishing.lua index 77cc50c6ce..a6049580e1 100644 --- a/rules/fuzzy_html_phishing.lua +++ b/rules/fuzzy_html_phishing.lua @@ -25,38 +25,24 @@ Detects phishing based on fuzzy hash mismatches: This indicates possible template reuse for phishing. ]] -local rspamd_logger = require "rspamd_logger" local lua_util = require "lua_util" local N = 'fuzzy_html_phishing' local function check_fuzzy_mismatch(task) local fuzzy_results = task:get_mempool():get_variable('fuzzy_result') - + if not fuzzy_results then return false end - - -- Collect results by type - local text_matches = {} - local html_matches = {} - - for _, hash_result in ipairs(fuzzy_results) do - local symbol = tostring(hash_result) - -- Parse fuzzy result format: "flag:hash:prob:type" - -- This is simplified - actual parsing depends on result format - - -- For now, check mempool variables set by fuzzy_insert_result - -- We need to enhance fuzzy_check to expose result types - end - + -- Get fuzzy check symbols from task results local fuzzy_symbols = task:get_symbols_all() local has_text_fuzzy = false local has_html_fuzzy = false local text_score = 0 local html_score = 0 - + for _, sym in ipairs(fuzzy_symbols) do if sym.name:match('FUZZY.*TEXT') or sym.name == 'R_FUZZY_HASH' then has_text_fuzzy = true @@ -67,7 +53,7 @@ local function check_fuzzy_mismatch(task) html_score = math.max(html_score, sym.score or 0) end end - + -- Scenario 1: Text matches legitimate but no HTML match -- This could indicate phishing with copied text but fake HTML/CTA if has_text_fuzzy and not has_html_fuzzy and text_score > 5.0 then @@ -78,7 +64,7 @@ local function check_fuzzy_mismatch(task) text_score) return true end - + -- Scenario 2: HTML matches but text doesn't (less suspicious) -- This is common for newsletters/notifications with varying content if has_html_fuzzy and not has_text_fuzzy and html_score > 8.0 then @@ -88,7 +74,7 @@ local function check_fuzzy_mismatch(task) html_score) -- Could add negative score or just log end - + return false end @@ -102,7 +88,7 @@ rspamd_config:register_symbol{ } -- Register callback -local id = rspamd_config:register_symbol{ +rspamd_config:register_symbol{ name = 'FUZZY_HTML_PHISHING_CHECK', type = 'callback', callback = check_fuzzy_mismatch,