golden hour

/var/lib/spamassassin/3.004006/updates_spamassassin_org

File/Folder	Size	Actions
10_default_prefs.cf	8.56 KB
10_hasbase.cf	2.39 KB
20_advance_fee.cf	7.43 KB
20_aux_tlds.cf	44.85 KB
20_body_tests.cf	7.01 KB
20_compensate.cf	1.89 KB
20_dnsbl_tests.cf	10.3 KB
20_drugs.cf	15.16 KB
20_dynrdns.cf	11.15 KB
20_fake_helo_tests.cf	9.42 KB
20_freemail.cf	2.99 KB
20_freemail_domains.cf	40.53 KB
20_freemail_mailcom_domains.cf	4.32 KB
20_head_tests.cf	26.83 KB
20_html_tests.cf	10.79 KB
20_imageinfo.cf	5.18 KB
20_mailspike.cf	2.86 KB
20_meta_tests.cf	3.42 KB
20_net_tests.cf	1.84 KB
20_pdfinfo.cf	15.53 KB
20_phrases.cf	7.96 KB
20_porn.cf	2.01 KB
20_ratware.cf	16.48 KB
20_uri_tests.cf	5.9 KB
20_vbounce.cf	20.28 KB
23_bayes.cf	2.94 KB
25_accessdb.cf	1.51 KB
25_antivirus.cf	1.5 KB
25_arc.cf	1.76 KB
25_asn.cf	1.93 KB
25_dcc.cf	2.89 KB
25_dkim.cf	5.12 KB
25_dmarc.cf	2.46 KB
25_dnswl.cf	2.99 KB
25_pyzor.cf	1.49 KB
25_razor2.cf	3.09 KB
25_replace.cf	25.66 KB
25_spf.cf	4.3 KB
25_textcat.cf	1.73 KB
25_uribl.cf	19.53 KB
25_url_redirectors.cf	6.33 KB
25_url_shortener.cf	11.28 KB
30_text_de.cf	25.69 KB
30_text_fr.cf	19.34 KB
30_text_it.cf	1.82 KB
30_text_nl.cf	20.15 KB
30_text_pl.cf	16.85 KB
30_text_pt_br.cf	41.93 KB
50_scores.cf	37.27 KB
60_adsp_override_dkim.cf	9.12 KB
60_awl.cf	1.48 KB
60_bayes_stopwords.cf	14.73 KB
60_shortcircuit.cf	2.36 KB
60_txrep.cf	1.31 KB
60_welcomelist.cf	11.34 KB
60_welcomelist_auth.cf	74.76 KB
60_welcomelist_dkim.cf	10.83 KB
60_welcomelist_spf.cf	6.1 KB
60_welcomelist_subject.cf	3.82 KB
72_active.cf	523.43 KB
72_scores.cf	31.17 KB
73_sandbox_manual_scores.cf	4.26 KB
MIRRORED.BY	1.05 KB
STATISTICS-set0-72_scores.cf.txt	1.46 KB
STATISTICS-set1-72_scores.cf.txt	1.46 KB
STATISTICS-set2-72_scores.cf.txt	0 B
STATISTICS-set3-72_scores.cf.txt	0 B
languages	130.47 KB
local.cf	3.14 KB
regression_tests.cf	2.71 KB
sa-update-pubkey.txt	4.67 KB
user_prefs.template	1.87 KB

Edit: 20_html_tests.cf

# SpamAssassin rules file: HTML tests
#
# Please don't modify this file as your changes will be overwritten with
# the next update. Use /etc/mail/spamassassin/local.cf instead.
# See 'perldoc Mail::SpamAssassin::Conf' for details.
#
# <@LICENSE>
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to you under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at:
# 
#     http://www.apache.org/licenses/LICENSE-2.0
# 
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# </@LICENSE>
#
###########################################################################

require_version 3.004006

# HTML parser tests
#
# please sort these by eval type then name

meta HTML_SHORT_LINK_IMG_1	__HTML_LENGTH_0000_1024 && __HTML_LINK_IMAGE
meta HTML_SHORT_LINK_IMG_2	__HTML_LENGTH_1024_1536 && __HTML_LINK_IMAGE
meta HTML_SHORT_LINK_IMG_3	__HTML_LENGTH_1536_2048 && __HTML_LINK_IMAGE
describe HTML_SHORT_LINK_IMG_1	HTML is very short with a linked image
describe HTML_SHORT_LINK_IMG_2	HTML is very short with a linked image
describe HTML_SHORT_LINK_IMG_3	HTML is very short with a linked image

meta HTML_SHORT_CENTER		(__HTML_LENGTH_384 && __TAG_EXISTS_CENTER)
describe HTML_SHORT_CENTER	HTML is very short with CENTER tag

meta HTML_TITLE_SUBJ_DIFF	__HTML_TITLE_SUBJ_DIFF && !__MIME_ATTACHMENT

meta HTML_CHARSET_FARAWAY	(__HTML_CHARSET_FARAWAY && __HIGHBITS)
describe HTML_CHARSET_FARAWAY	A foreign language charset used in HTML markup
tflags HTML_CHARSET_FARAWAY	userconf

meta HTML_MIME_NO_HTML_TAG	MIME_HTML_ONLY && !__TAG_EXISTS_HTML
describe HTML_MIME_NO_HTML_TAG	HTML-only message, but there is no HTML tag

meta HTML_MISSING_CTYPE		(!__MIME_HTML && HTML_MESSAGE)
describe HTML_MISSING_CTYPE	Message is HTML without HTML Content-Type

###########################################################################
# rawbody HTML tests

rawbody HIDE_WIN_STATUS		/<[^>]{1,1000}onMouseOver=[^>]{1,1000}window\.status=/i
describe HIDE_WIN_STATUS	Javascript to hide URLs in browser

rawbody __OBFUSCATING_COMMENT_A	/\w(?:<![^>]*>)+\w/
rawbody __OBFUSCATING_COMMENT_B	/[^\s>](?:<![^>]*>)+[^\s<]/
ifplugin Mail::SpamAssassin::Plugin::HTMLEval
ifplugin Mail::SpamAssassin::Plugin::MIMEEval
meta OBFUSCATING_COMMENT	((__OBFUSCATING_COMMENT_A && HTML_MESSAGE) || (__OBFUSCATING_COMMENT_B && MIME_HTML_ONLY)) && !__ISO_2022_JP_DELIM
describe OBFUSCATING_COMMENT	HTML comments which obfuscate text
endif
endif

# spams that are assembled from a Javascript array
# look for the XOR op
rawbody __JS_FROMCHARCODE       /String\.fromCharCode\s*\(\s*\S+\s*\[\s*\S+\s*\]\s*\^/
rawbody __JS_DOCWRITE           /document\.write/
meta JS_FROMCHARCODE            (__JS_FROMCHARCODE && __JS_DOCWRITE)
describe JS_FROMCHARCODE        Document is built from a Javascript charcode array

# a good possible rule that may resurface
# ! $ % ' ( ) , - . / : ; = ? @ _
#rawbody ENTITY_DEC_OTHER	/\&\#0*(?:3[3679]|4[014567]|5[89]|6[134]|95)\;/
#describe ENTITY_DEC_OTHER	HTML contains needlessly encoded punctuation

body __HIGHBITS                     /(?:[\x80-\xff].?){4}/
# note: __HIGHBITS is used by HTML_CHARSET_FARAWAY

###########################################################################

ifplugin Mail::SpamAssassin::Plugin::HTMLEval

# HTML control test, HTML spam rules should all have better S/O than this
body HTML_MESSAGE		eval:html_test('html')
describe HTML_MESSAGE		HTML included in message

# HTML comment tests
body HTML_COMMENT_SHORT		eval:html_text_match('comment', '<!(?!-).{0,6}>')
describe HTML_COMMENT_SHORT	HTML comment is very short

body HTML_COMMENT_SAVED_URL	eval:html_text_match('comment', '<!-- saved from url=$\d{4}$')
describe HTML_COMMENT_SAVED_URL	HTML message is a saved web page

body HTML_EMBEDS		eval:html_test('embeds')
describe HTML_EMBEDS		HTML with embedded plugin object

body HTML_EXTRA_CLOSE		eval:html_range('closed_extra_ratio', '0.09', 'inf')
describe HTML_EXTRA_CLOSE	HTML contains far too many close tags

if (version < 4.000000)
  body HTML_FONT_SIZE_LARGE	eval:html_range('max_size', '5', '6')
  describe HTML_FONT_SIZE_LARGE	HTML font size is large

body HTML_FONT_SIZE_HUGE	eval:html_range('max_size', '6', 'inf')
  describe HTML_FONT_SIZE_HUGE	HTML font size is huge
endif

if (version >= 4.000000)
  body HTML_FONT_SIZE_LARGE	eval:html_range('max_size', '18', '24')
  describe HTML_FONT_SIZE_LARGE	HTML font size is large

body HTML_FONT_SIZE_HUGE	eval:html_range('max_size', '24', 'inf')
  describe HTML_FONT_SIZE_HUGE	HTML font size is huge
endif

body HTML_FONT_LOW_CONTRAST	eval:html_test('font_low_contrast')
describe HTML_FONT_LOW_CONTRAST	HTML font color similar or identical to background

body HTML_FONT_FACE_BAD		eval:html_test('font_face_bad')
describe HTML_FONT_FACE_BAD	HTML font face is not a word

body HTML_FORMACTION_MAILTO	eval:html_test('form_action_mailto')
describe HTML_FORMACTION_MAILTO	HTML includes a form which sends mail

# HTML_IMAGE_ONLY - not much raw HTML with images (absolute)
body HTML_IMAGE_ONLY_04		eval:html_image_only('0000','0400')
body HTML_IMAGE_ONLY_08		eval:html_image_only('0400','0800')
body HTML_IMAGE_ONLY_12		eval:html_image_only('0800','1200')
body HTML_IMAGE_ONLY_16		eval:html_image_only('1200','1600')
body HTML_IMAGE_ONLY_20		eval:html_image_only('1600','2000')
body HTML_IMAGE_ONLY_24		eval:html_image_only('2000','2400')
body HTML_IMAGE_ONLY_28		eval:html_image_only('2400','2800')
body HTML_IMAGE_ONLY_32		eval:html_image_only('2800','3200')
describe HTML_IMAGE_ONLY_04	HTML: images with 0-400 bytes of words
describe HTML_IMAGE_ONLY_08	HTML: images with 400-800 bytes of words
describe HTML_IMAGE_ONLY_12	HTML: images with 800-1200 bytes of words
describe HTML_IMAGE_ONLY_16	HTML: images with 1200-1600 bytes of words
describe HTML_IMAGE_ONLY_20	HTML: images with 1600-2000 bytes of words
describe HTML_IMAGE_ONLY_24	HTML: images with 2000-2400 bytes of words
describe HTML_IMAGE_ONLY_28	HTML: images with 2400-2800 bytes of words
describe HTML_IMAGE_ONLY_32	HTML: images with 2800-3200 bytes of words

# HTML_IMAGE_RATIO - more image area than text (ratio)
body HTML_IMAGE_RATIO_02	eval:html_image_ratio('0.000','0.002')
body HTML_IMAGE_RATIO_04        eval:html_image_ratio('0.002','0.004')
body HTML_IMAGE_RATIO_06        eval:html_image_ratio('0.004','0.006')
body HTML_IMAGE_RATIO_08        eval:html_image_ratio('0.006','0.008')
describe HTML_IMAGE_RATIO_02    HTML has a low ratio of text to image area
describe HTML_IMAGE_RATIO_04    HTML has a low ratio of text to image area
describe HTML_IMAGE_RATIO_06    HTML has a low ratio of text to image area
describe HTML_IMAGE_RATIO_08    HTML has a low ratio of text to image area

# HTML obfuscation
body HTML_OBFUSCATE_05_10	eval:html_range('obfuscation_ratio','.05','.1')
body HTML_OBFUSCATE_10_20	eval:html_range('obfuscation_ratio','.1','.2')
body HTML_OBFUSCATE_20_30	eval:html_range('obfuscation_ratio','.2','.3')
body HTML_OBFUSCATE_30_40	eval:html_range('obfuscation_ratio','.3','.4')
body HTML_OBFUSCATE_50_60	eval:html_range('obfuscation_ratio','.5','.6')
body HTML_OBFUSCATE_70_80	eval:html_range('obfuscation_ratio','.7','.8')
body HTML_OBFUSCATE_90_100	eval:html_range('obfuscation_ratio','.9','1.0')
describe HTML_OBFUSCATE_05_10	Message is 5% to 10% HTML obfuscation
describe HTML_OBFUSCATE_10_20	Message is 10% to 20% HTML obfuscation
describe HTML_OBFUSCATE_20_30	Message is 20% to 30% HTML obfuscation
describe HTML_OBFUSCATE_30_40	Message is 30% to 40% HTML obfuscation
describe HTML_OBFUSCATE_50_60	Message is 50% to 60% HTML obfuscation
describe HTML_OBFUSCATE_70_80	Message is 70% to 80% HTML obfuscation
describe HTML_OBFUSCATE_90_100	Message is 90% to 100% HTML obfuscation

body HTML_TAG_BALANCE_BODY	eval:html_tag_balance('body', '!= 0')
describe HTML_TAG_BALANCE_BODY	HTML has unbalanced "body" tags

body HTML_TAG_BALANCE_HEAD	eval:html_tag_balance('head', '!= 0')
describe HTML_TAG_BALANCE_HEAD	HTML has unbalanced "head" tags

body HTML_TAG_EXIST_BGSOUND	eval:html_tag_exists('bgsound')
describe HTML_TAG_EXIST_BGSOUND	HTML has "bgsound" tag

# percentage of tags that are not legal elements in HTML
body HTML_BADTAG_40_50	eval:html_range('bad_tag_ratio','0.40','0.50')
body HTML_BADTAG_50_60	eval:html_range('bad_tag_ratio','0.50','0.60')
body HTML_BADTAG_60_70	eval:html_range('bad_tag_ratio','0.60','0.70')
body HTML_BADTAG_90_100	eval:html_range('bad_tag_ratio','0.90','1.00')
describe HTML_BADTAG_40_50	HTML message is 40% to 50% bad tags
describe HTML_BADTAG_50_60	HTML message is 50% to 60% bad tags
describe HTML_BADTAG_60_70	HTML message is 60% to 70% bad tags
describe HTML_BADTAG_90_100	HTML message is 90% to 100% bad tags

# percentage of unique non-elements in HTML
body HTML_NONELEMENT_30_40	eval:html_range('non_element_ratio','0.30','0.40')
body HTML_NONELEMENT_40_50	eval:html_range('non_element_ratio','0.40','0.50')
body HTML_NONELEMENT_60_70	eval:html_range('non_element_ratio','0.60','0.70')
body HTML_NONELEMENT_80_90	eval:html_range('non_element_ratio','0.80','0.90')
describe HTML_NONELEMENT_30_40	30% to 40% of HTML elements are non-standard
describe HTML_NONELEMENT_40_50	40% to 50% of HTML elements are non-standard
describe HTML_NONELEMENT_60_70	60% to 70% of HTML elements are non-standard
describe HTML_NONELEMENT_80_90	80% to 90% of HTML elements are non-standard

# short HTML messages with certain attributes
body __HTML_LINK_IMAGE		eval:html_text_match('anchor', '<img>')
body __HTML_LENGTH_0000_1024	eval:html_range('length', '0', '1024')
body __HTML_LENGTH_1024_1536	eval:html_range('length', '1024', '1536')
body __HTML_LENGTH_1536_2048	eval:html_range('length', '1536', '2048')

body __HTML_LENGTH_512		eval:html_eval('length', '< 512')
body __COMMENT_EXISTS		eval:html_text_match('comment', '<!.*?>')

body __HTML_LENGTH_384		eval:html_eval('length', '< 384')
body __TAG_EXISTS_CENTER	eval:html_tag_exists('center')

body __HTML_TITLE_120		eval:html_text_match('title', '.{120}')

body __HTML_TITLE_SUBJ_DIFF	eval:html_title_subject_ratio('3.5')

body __HTML_CHARSET_FARAWAY	eval:html_charset_faraway()

body HTML_IFRAME_SRC	eval:check_iframe_src()
describe HTML_IFRAME_SRC	Message has HTML IFRAME tag with SRC URI

else

meta __COMMENT_EXISTS		0
meta __TAG_EXISTS_CENTER	0

endif

###########################################################################

ifplugin Mail::SpamAssassin::Plugin::MIMEEval

# __MIME_ATTACHMENT also used in 20_meta_tests.cf
body __MIME_ATTACHMENT		eval:check_for_mime('mime_attachment')
priority __MIME_ATTACHMENT	-2000 # Bug 8078

endif