CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
spacer spacer

Filter for 'white' fonts in msg
Goto page Previous  1, 2, 3  Next
 
Post new topic   Reply to topic       All -> FavForums -> Product Suggestions [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16543

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Sun Dec 14, 2003 7:41 pm    Post subject:
Reply with quote

Anonymous wrote:
Ghol wrote:
I'm new to all thisREgExpr stuff, and tried to use the above filter on this HTML: <FONT color=3D#ffffff size=3D2>, but it didn't work until I changed the ["?] to ["]?. Not sure I understand why...


You may be new...but you did find a mistake in my code.

The correct RegRxp should read:
Code:
<font [^>]*? color=(3D)?["]?(white|#(F[6-9A-F]){3})["]?(?# very light colored fonts )


in fact....you could also do the following with no ill effects:
Code:
<font [^>]*? color=(3D)?["]?(white|#(F[6-9A-F]){3})(?# very light colored fonts )


Thanks for having good troubleshooting skills, Ghol...and for pointing it out... Smile

I second that! Thank You And I, having gotten a hit with this regex, thought everything was cool! Must have been one with the colour code being enclosed within quotes.... Duel II

Edit: Fixed a logical error (italicized)



Last edited by Ikeb on Sun Dec 14, 2003 7:52 pm, edited 1 time in total
Back to top
View users profile Send private message
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16543

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Sun Dec 14, 2003 7:44 pm    Post subject:
Reply with quote

Ghol wrote:
Yes, I also guessed there is no need to include the second set of inverted commas.
Would you believe it, I got my first "hit" with the filter just 20 minutes ago, almost immediately after putting it in place!
As I analysed the HTML in an editor, I realised you could surely couple the light colour filter with a darker "bgcolor" filter, so that it wouldn't fire if the background made the text legible....
i.e. If the filter registered (previous to the lighter text) the presence of something approaching bgcolor=#000000, it would allow it through.

Hehe. Let me know when you have the regex for that one!

Back to top
View users profile Send private message
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16543

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Sun Dec 14, 2003 7:49 pm    Post subject:
Reply with quote

denn988 wrote:
If all you wanted was a color reference I could have just posted this link.

The page that the link takes you to contains nothing but color samples from the index point in the link to the bottom of the page. Thousands of different colors.

Thanks but I have lots like that. Yours is much more to the point .... and pretty to boot!


denn988 wrote:
As far as my e-mail address goes...try this:<blockquote>president@whitehorse.gov</blockquote>It's as good as anything that you would get out of me....

Er ... JB, you meant president@whitehouse.gov didn't you? I'll fire you off a copy right away Sir!

Back to top
View users profile Send private message
Ghol

Trooper
Trooper


Joined: Dec 14, 2003
Posts: 14
Location: Germany

PostPosted: Sun Dec 14, 2003 7:51 pm    Post subject:
Reply with quote

@Ikeb -- other way round: your hit was surely one that *was* enclosed by quotes.
As was said above by Denn998 (sorry I haven't got the hang of quoting): "The part of the expression that reads ["?] would mean that the RegExp is looking for either a " or a ? At least one of them must be present for the expression to be true."

Back to top
View users profile Send private message
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16543

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Sun Dec 14, 2003 7:54 pm    Post subject:
Reply with quote

Ghol wrote:
@Ikeb -- other way round: your hit was surely one that *was* enclosed by quotes.
As was said above by Denn998 (sorry I haven't got the hang of quoting): "The part of the expression that reads ["?] would mean that the RegExp is looking for either a " or a ? At least one of them must be present for the expression to be true."

You're just too quick for me Ghol. Shocked I noticed my error as I reread my post and just fixed it, but not before you spotted it....

Back to top
View users profile Send private message
denn988

Guest
IP: 66.44.*.*






PostPosted: Sun Dec 14, 2003 8:24 pm    Post subject:
Reply with quote

Ikeb wrote:
denn988 wrote:
If all you wanted was a color reference I could have just posted this link.

The page that the link takes you to contains nothing but color samples from the index point in the link to the bottom of the page. Thousands of different colors.

Thanks but I have lots like that. Yours is much more to the point .... and pretty to boot!


denn988 wrote:
As far as my e-mail address goes...try this:<blockquote>president@whitehorse.gov</blockquote>It's as good as anything that you would get out of me....

Er ... JB, you meant president@whitehouse.gov didn't you? I'll fire you off a copy right away Sir!



Ikeb...

No.....I meant      president@whitehorse.gov      I would never present myself to be 'National Command Authority (NCA)' having previously been responsible to him for the transmission of certain messages.

Besides....on the day that the announcement was made that      We Got Him      I think that 'NCA' just might be allowed to ride his 'white horse' regardless of whether you voted for him or not.

Back to top
stan_qaz

Premium Member


Joined: Mar 31, 2003
Posts: 10635

Premium

PostPosted: Sun Dec 14, 2003 10:38 pm    Post subject:
Reply with quote

Tough call, dig him out, start asking questions, try him somewhere and shoot him or drop a grenade in the hole and fill it back in.


_________________
Questions? Try the wiki
http://wiki.castlecops.com/MailWasher_Pro
Back to top
View users profile Send private message
denn988

Guest
IP: 66.44.*.*






PostPosted: Mon Dec 15, 2003 12:04 am    Post subject:
Reply with quote

I caught another 'space' problem with the filter. It occured when I modified it to ensure a space before 'color'...and neglected to remove the previous space after font.

Change the code for this filter to read:

Code:
<font[^>]*? color=(3D)?["]?(white|#(F[6-9A-F]){3})(?# very light colored fonts )


Again....you may adjust the sensitivity of the color coding as desired.


SUGGESTION TO FIRETRUST.....

Perhaps you could change the font used inside the textbox for the rules in your filter Edit Dialog Box to <tt> 'Courier New' </tt> or some other NON-proportional font.

That would make it a lot easier to read the text in that box.

Back to top
denn988

Guest
IP: 66.44.*.*






PostPosted: Mon Dec 15, 2003 12:15 am    Post subject:
Reply with quote

Ikeb wrote:
Ghol wrote:
Yes, I also guessed there is no need to include the second set of inverted commas.
Would you believe it, I got my first "hit" with the filter just 20 minutes ago, almost immediately after putting it in place!
As I analysed the HTML in an editor, I realised you could surely couple the light colour filter with a darker "bgcolor" filter, so that it wouldn't fire if the background made the text legible....
i.e. If the filter registered (previous to the lighter text) the presence of something approaching bgcolor=#000000, it would allow it through.

Hehe. Let me know when you have the regex for that one!


He will learn that there are some things that you can do with RegExp as it is impemented in MWP....as some things that you can't. I wish that was something that could easily be done...but I can't see any way to do it without an advanced 'sub-rule' structure in MWP's filters. Even with that...it would not be easy.

If he does figure it out....he ought to be knighted on Gary's Filter Page.... Wink

Back to top
denn988

Guest
IP: 66.44.*.*






PostPosted: Mon Dec 15, 2003 1:09 am    Post subject:
Reply with quote

One more thing concerning Body or background colors...

Most people don't change the body color or background color of any e-mail they send you.

You have to figure that anyone who does mess with either the background or body color is doing it to get your attention...in other words...an advertising method.

The way I look at it is that if someone I don't know, or who is not on my friends list sends me something like that...they must be trying to sell me something.

In those cases where they send messages with very light font colors to me....my response is an "AUTO-DELETE" via the filter. I don't care what the background color might be. If they are not trying to hide tracking words..they are trying to dazzle me with colors. Either way....they are DOA.


By the way....that is another thing that Firetrust might like to put into their program....user chosen sounds whenever a filter fires and Auto-deletes.

My choice would be the sound of a toilet flushing each time my filter fires. Cool

Back to top
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16543

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Mon Dec 15, 2003 2:08 am    Post subject:
Reply with quote

denn988 wrote:
ikeb wrote:
denn988 wrote:
As far as my e-mail address goes...try this:<blockquote>president@whitehorse.gov</blockquote>It's as good as anything that you would get out of me....

Er ... JB, you meant president@whitehouse.gov didn't you? I'll fire you off a copy right away Sir!

No.....I meant      president@whitehorse.gov      I would never present myself to be 'National Command Authority (NCA)' having previously been responsible to him for the transmission of certain messages.

You were/are kidding of course WRT the email address .... especially since whitehorse.gov is a non-existant domain ... so I responded in kind. There was no intent on my part to make any sort of political statement



Last edited by Ikeb on Mon Dec 15, 2003 2:18 am, edited 1 time in total
Back to top
View users profile Send private message
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16543

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Mon Dec 15, 2003 2:13 am    Post subject:
Reply with quote

denn988 wrote:
I caught another 'space' problem with the filter. It occured when I modified it to ensure a space before 'color'...and neglected to remove the previous space after font.

Thanks for the correction. I didn't spot it either. I trust you too much it seems..... Razz

Back to top
View users profile Send private message
Ghol

Trooper
Trooper


Joined: Dec 14, 2003
Posts: 14
Location: Germany

PostPosted: Mon Dec 15, 2003 5:00 am    Post subject:
Reply with quote

Hey, I'm not aspiring to a knighthood... I have very quickly become aware of the limitations and dangers involved, having automatically deleted genuine emails because of not thinking about all the consequences of certain filters (e.g. those harmless words like 'weight loss' or 'degree' used in a different way than you would expect).

Yes, that 'space' problem was actually the first thing I corrected (more by chance than analysis), but completely forgot to mention it.

As regards a 'sub rule' for the background, you may be right. But as long as the mail contains any kind of 'bgcolor=' coding for a dark background (which would be unusual enough) coupled with the light font, that would make it potentially genuine. Without any dark bgcolor reference at all, it would then be suspicious, but you couldn't safely auto-delete!

In fact, it might be a better (even possible) strategy to look at *any* 'bgcolor' used and compare it with the presence of a light 'font color' (Denn998's filter), since any kind of even mid-color background would cause the light text to stand out.

And anyway, as Denn998 points out, surely no-one sends offers on a pink or blue background (maybe I don't know spam)! Isn't the background is going to be white in almost every case?? And surely no-one ever changes the bgcolor of his mail – except for HTML newsletters using tables, which can be on the 'friends' list.

Back to top
View users profile Send private message
Ghol

Trooper
Trooper


Joined: Dec 14, 2003
Posts: 14
Location: Germany

PostPosted: Mon Dec 15, 2003 5:05 am    Post subject: Enhancement of filter function
Reply with quote

denn988 wrote:
SUGGESTION TO FIRETRUST.....

Perhaps you could change the font used inside the textbox for the rules in your filter Edit Dialog Box to <tt> 'Courier New' </tt> or some other NON-proportional font.

That would make it a lot easier to read the text in that box.


Wouldn't it be a more urgent priority to (be able to) extend the length of the filter fields? It's annoying to have to click back and forth to see what you have written.
I expect I am by no means the first to suggest that.

Back to top
View users profile Send private message
Ikeb

Special Response Team
Forums Admin

Joined: Apr 20, 2003
Posts: 16543

Forums Admin Moderators MVP Premium SRT Team CC Committee Team F@H

PostPosted: Mon Dec 15, 2003 6:20 am    Post subject:
Reply with quote

Ghol wrote:
And anyway, as Denn998 points out, surely no-one sends offers on a pink or blue background (maybe I don't know spam)! Isn't the background is going to be white in almost every case?? And surely no-one ever changes the bgcolor of his mail – except for HTML newsletters using tables, which can be on the 'friends' list.

There too many "surely"s in there for my liking. IMO there are too many possibilities to try and guess motivations. The fact of the matter is that a bgcolor close to a font color will obscure the text, conversely a "significant" difference will not. Because there's no regex that can suss that out I'd say it would be safest to keep an eye on any color filter hits.

BTW, there is also the background image possibility to consider....

Back to top
View users profile Send private message
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Product Suggestions All times are GMT
Goto page Previous  1, 2, 3  Next
Page 2 of 3

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer