]> git.ipfire.org Git - thirdparty/rspamd.git/commit
[Fix] Fix url_suspect plugin causing massive false positives
authorVsevolod Stakhov <vsevolod@rspamd.com>
Fri, 21 Nov 2025 11:12:55 +0000 (11:12 +0000)
committerVsevolod Stakhov <vsevolod@rspamd.com>
Fri, 21 Nov 2025 11:12:55 +0000 (11:12 +0000)
commitb9f84dff495d6100e6af0ba26e4d6042245442ed
tree07656440a3da1d65cebc8e0528c5fecc43c13567
parent3f5ae3ca5ed1a0d2ec3e0ddbc532ae5cf782e4d7
[Fix] Fix url_suspect plugin causing massive false positives

The url_suspect plugin had multiple critical issues:

1. R_SUSPICIOUS_URL triggered on every message with URLs, adding 25 points
   due to incorrect dynamic score usage (5.0 * 5.0 instead of 1.0 * 5.0)

2. Broken compat_mode inserted R_SUSPICIOUS_URL without URL info whenever
   ANY url check triggered, making it impossible to debug

3. Symbol names were unnecessarily configurable, adding complexity

4. url_suspect_group.conf was not included in groups.conf, so scores
   were not loaded at all

Fixed by:
- Removed R_SUSPICIOUS_URL and compat_mode completely
- Fixed all insert_result() calls to use 1.0 dynamic weight
- Made symbol names hardcoded constants
- Added url group to groups.conf with max_score = 9.0
- Cleaned up score configuration parameters
conf/groups.conf
conf/modules.d/url_suspect.conf
conf/scores.d/url_suspect_group.conf
src/plugins/lua/url_suspect.lua
test/functional/cases/001_merged/400_url_suspect.robot