[bugs][ bogofilter-Bugs-817817 ] BF should decode &#65

[SourceForge.net <no...@so...>]

Bugs item #817817, was opened at 2003-10-04 11:46
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=499997&aid=817817&group_id=62265

Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: Tim Freeman (timfreeman)
Assigned to: Nobody/Anonymous (nobody)
Summary: BF should decode &#65

Initial Comment:
I received the following spam with a style of HTML 

obfuscation I have not seen before:





<font color="#FFFFFD">summon her allies), then the

lesser states will hold aloof and </font><FONT SIZE=3

PTSIZE=12><br>

=<!--89-->==&#61;=&#61;===<!--6-->==&#61;=<!--8-->=====&#61;&#61;==&#61;=<!--W-->==<!--4-->=<!--i-->=<!--5r-->==&#61;===&#61;===========<br>

Get<!--vE--> &#65;N<!--4-->Y R&#88;<!--cs-->

D<!--3-->r&#117;&#103;s<!--N-->

Y&#111;&#117;&#32;&#78;<!--18-->E&#69;D&#32;&#111;r&#32;R<!--1z-->e<!--7-->fi&#108;l&#115;!!<BR>

=<!--NQ-->==========<!--7Q-->===&#61;<!--2-->==&#61;====<!--9-->==&#61;==<!--00-->=<!--8T-->==&#61;&#61;=<!--M-->====<!--3-->=<!--X1-->=======&#61;<br>

<font color="#FFFFFA">1,500. It came therefore to

L67,500, and L80,000 more for fitting it up,</font><br>

OUR<!--Tn--> US D<!--2-->oc&#116;o<!--51-->r<!--mC-->s

&#119;il<!--5d-->l

<!--1-->Wr&#105;<!--1i-->t<!--5-->e&#32;&#89;OU

a&#32;<!--29-->Pre&#115;cri<!--m-->pti<!--1-->on<!--0-->

f&#111;r <!--93-->F<!--4U-->REE<BR>

You w<!--e8-->il<!--0-->l<!--X--> <!--k-->g&#101;t it

NEX&#84;-D&#65;Y

via&#32;Fed<!--Lg-->-&#69;x!&#33;</FONT><BR>

<font color="#FFFFF2">The human mind delights in grand

conceptions of supernatural beings.</font><br>

<a

href="http://ww%77.&#101;d%64y&#116;s&#101;d.bi&#122;/%76%70r%36651/"><!--1C-->Visi&#116;<!--NL-->

&#84;o<!--F-->d<!--5-->ay</a><BR>

<BR><font color="#FFFFF4">Almanac, if he made a point

of being acquainted with every thing</font><br>

<FONT SIZE=1><a

href="http://www&#46;%65ddyt%73&#101;d.b&#105;z/u&#110;s&#117;bs%63r&#105;be.d%64d">&#80;l<!--cz-->e<!--a1-->as&#101;<!--6-->

<!--UT-->n<!--5-->o&#32;mo&#114;e</a></FONT><p>

<font color="#FFFFF5">have to do with musical

composers, a piano, and a brief revery</font></p></FONT>



The page looks like this on browser:



==============================================

Get ANY RX Drugs You NEED or Refills!!

==============================================

OUR US Doctors will Write YOU a Prescription for FREE

You will get it NEXT-DAY via Fed-Ex!!



Feeding the email into "bogofilter -vvv" shows that it

doesn't

see the word "Prescription" there.  Instead, it sees "Pre"

and doesn't notice that "&#115;" is the same as "s".  It

would be better if it understood the &# HTML escapes.



I observed this with bogofilter 0.15.4-1, which is nearly

the current version available by Debian.  I didn't try 

0.15.5 yet.  My apologies if this bug is recently fixed.



Incidentally, bogofilter is also distracted by the

almost-white 

text and sees words like "Almanac" in the email that

aren't 

visible in the browser.  I don't see a way to solve this so

I'm not officially reporting it here and now, but I'll

mention it

just in case someone else sees a fix.  You can't simply

ignore nearly-white text, since then the spammer can

write their message in white text against a dark

background.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=499997&aid=817817&group_id=62265