mailbaby / rspamd-rules

rspamd rules
Apache License 2.0
23 stars 4 forks source link

MB_SUBJECT_REGEX is crashing Rspamd #7

Open spec1re opened 1 year ago

spec1re commented 1 year ago

This map:

#manually generated higher score subject used in spam
MB_SUBJECT_REGEX {
 type = "header";
 header = "subject";
 regexp = true;
 map = "https://maps.mailbaby.net/subject_block.map";
 score = 10.0;
}

is crashing Rspamd Version 3.7.3 on FreeBSD 14.0-CURRENT (amd64).

2023-11-09 11:21:59 #43238(main) <taisnh>; map; rspamd_regexp_list_fin: read regexp list of 91 elements
2023-11-09 11:21:59 #43238(main) <738z38>; map; rspamd_regexp_list_fin: read regexp list of 88 elements
2023-11-09 11:21:59 #43238(main) <ymqxx1>; map; rspamd_map_read_http_cached_file: read cached data for https://maps.mailbaby.net/spam_words.map from /var/db/rspamd/60b9f7a460d2df55572770a9bf760def9d332f3d.map, 1582 bytes; next check at: 2023-11-09 11:21:59; last modified on: 2023-11-09 11:20:30; etag: (NULL)
2023-11-09 11:21:59 #43238(main) <ymqxx1>; map; rspamd_regexp_list_fin: read regexp list of 86 elements
2023-11-09 11:21:59 #43238(main) <7yoetj>; map; rspamd_map_helper_insert_re: cannot parse regexp /^*****SPAM***** Confirmation Receipt \!$/: regexp parsing error: 'quantifier does not follow a repeatable item' at position 1; pattern: ^*****SPAM***** Confirmation Receipt \!$
2023-11-09 11:21:59 #43238(main) <7yoetj>; map; rspamd_map_helper_insert_re: cannot parse regexp /*****SPAM***** You have won an\./: regexp parsing error: 'quantifier does not follow a repeatable item' at position 0; pattern: *****SPAM***** You have won an\.
2023-11-09 11:21:59 #43238(main) <7yoetj>; map; rspamd_map_helper_insert_re: cannot parse regexp /*****SPAM***** At a Loss for What Gadgets to Buy\? Check Out Our List\!/: regexp parsing error: 'quantifier does not follow a repeatable item' at position 0; pattern: *****SPAM***** At a Loss for What Gadgets to Buy\? Check Out Our List\!
#logfile ends here#

comenting that map out and rspamd returns to normal oparation. I have a rspamd-3.7.3.core crashdump on hand if needed.

spec1re commented 1 year ago

Thanks fixed now, should we report this to the rspamd dev team?

Just a couple of duplicates.

2023-11-10 06:07:50 #72070(controller) <7yoetj>; map; rspamd_map_helper_insert_re: duplicate re entry found for map https://maps.mailbaby.net/subject_block.map: /^\*\*\*\*\*SPAM\*\*\*\*\* Confirmation Receipt \!$/ (old value: '1', new: '1')
2023-11-10 06:08:20 #72639(normal) <7yoetj>; map; rspamd_map_helper_insert_re: duplicate re entry found for map https://maps.mailbaby.net/subject_block.map: /^\*\*\*\*\*SPAM\*\*\*\*\* Confirmation Receipt \!$/ (old value: '1', new: '1')
2023-11-10 06:08:23 #72319(normal) <7yoetj>; map; rspamd_map_helper_insert_re: duplicate re entry found for map https://maps.mailbaby.net/subject_block.map: /^\*\*\*\*\*SPAM\*\*\*\*\* Confirmation Receipt \!$/ (old value: '1', new: '1')
JQuags commented 1 year ago

I was able to reproduce it on 3.7.3 with freebsd 13.2 escaping the resolved it for me. Re-thinking it was probably seen as a greedy metacharacter not a literal *.

spec1re commented 1 year ago

Great thanks.