[Mimedefang] New way of obfuscating text

[Brent J. Nordquist]

On Tue, 10 Feb 2004, Michael Sims <michaels at crye-leike.com> wrote:

> rawbody  SA_CUSTOM_TINY_FONT /font-size:\s*[01]\s*(?:p[xt])?\s*;/i
> describe SA_CUSTOM_TINY_FONT HTML message contains unreadable font size
> score    SA_CUSTOM_TINY_FONT 0.1

For comparison, here's the one Bob Menschel posted to the SA list, with
some improvements I made.  I would drop the ";" (see below for why):

rawbody  RM_rbh_0ptFont  /font-size:\s*[01]p[tx]\b/i
describe RM_rbh_0ptFont  HTML includes 0- or 1-point font size; invisible text

Sometimes it's terminated with tag end:        "font-size: 0pt>"
[e.g. the whole style= tag attribute isn't quoted.]

Sometimes the space is left out:               "font-size:0pt"
Sometimes it's a 1-point font, equally bogus:  "font-size: 1pt"
Sometimes I see "px" instead of "pt":          "font-size: 1px"

-- 
Brent J. Nordquist <b-nordquist at bethel.edu> N0BJN
Other contact information: http://kepler.acns.bethel.edu/~bjn/contact.html
* Fast pipe * Always on * Get out of the way - Tim Bray http://tinyurl.com/7sti