From: Vsevolod Stakhov <vsevolod@rspamd.com>
Date: Wed, 8 Jul 2026 12:59:27 +0000 (+0100)
Subject: [Test] phishing: no FP for same label under different suffix
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=61b89f4e70b6158b023b9ecd17752274311880bc;p=thirdparty%2Frspamd.git

[Test] phishing: no FP for same label under different suffix

Regression test: brand.co.za displayed over a brand.com href must not
fire PHISHING (uses co.za since the functional test tld file has no
co.uk)
---

diff --git a/test/functional/cases/001_merged/114_phishing.robot b/test/functional/cases/001_merged/114_phishing.robot
index c553cea627..c83543b4ad 100644
--- a/test/functional/cases/001_merged/114_phishing.robot
+++ b/test/functional/cases/001_merged/114_phishing.robot
@@ -12,6 +12,7 @@ ${MESSAGE_QMULTI}     ${RSPAMD_TESTDIR}/messages/phishing_query_multi.eml
 ${MESSAGE_QNESTED}    ${RSPAMD_TESTDIR}/messages/phishing_query_nested.eml
 ${MESSAGE_QNESTFIRE}  ${RSPAMD_TESTDIR}/messages/phishing_query_nested_fire.eml
 ${MESSAGE_QOVERCAP}   ${RSPAMD_TESTDIR}/messages/phishing_query_overcap.eml
+${MESSAGE_XTLD}       ${RSPAMD_TESTDIR}/messages/phishing_same_label_cross_tld.eml
 ${SETTINGS_PHISHING}  {symbols_enabled = [PHISHING,STRICT_PHISHING,STRICTER_PHISHING]}
 
 *** Test Cases ***
@@ -30,6 +31,14 @@ TEST PHISHING STRICT TWO
   ...  Settings=${SETTINGS_PHISHING}
   Expect Symbol  STRICTER_PHISHING
 
+TEST PHISHING NO FP FOR SAME LABEL UNDER DIFFERENT PUBLIC SUFFIX
+  # The displayed domain and the href target share the registrable label and
+  # differ only in the public suffix (brand.co.za shown over brand.com) -- a
+  # common legitimate cross-TLD brand link, not phishing.
+  Scan File  ${MESSAGE_XTLD}
+  ...  Settings=${SETTINGS_PHISHING}
+  Do Not Expect Symbol  PHISHING
+
 TEST PHISHING NO FP WHEN HREF QUERY DEST EQUALS DISPLAY TEXT
   # href host differs from the displayed domain, but the href's query embeds a
   # destination URL equal to the displayed domain (a wrapper/redirector that
diff --git a/test/functional/messages/phishing_same_label_cross_tld.eml b/test/functional/messages/phishing_same_label_cross_tld.eml
new file mode 100644
index 0000000000..3f0a2fc453
--- /dev/null
+++ b/test/functional/messages/phishing_same_label_cross_tld.eml
@@ -0,0 +1,3 @@
+Content-type: text/html
+
+lol <a href="http://www.davidaustinroses.com">http://www.davidaustinroses.co.za</a>