[Bug 8347] New: URI_GOOG_STO_SPAMMY contributed significantly to FP

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8347

            Bug ID: 8347
           Summary: URI_GOOG_STO_SPAMMY contributed significantly to FP
           Product: Spamassassin
           Version: unspecified
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: minor
          Priority: P2
         Component: Rules
          Assignee: [email protected]
          Reporter: [email protected]
  Target Milestone: Undefined

One of our customers reported a false positive to us that hit
URI_GOOG_ST_SPAMMY.  The message was from a local veterinarian.

Hand-scanning the message to inspect the debug output brings up this:

Sep  2 11:56:37.261 [569595] dbg: rules: ran uri rule URI_GOOG_STO_SPAMMY
======> got hit: "https://storage.googleapis.com/msgsndr/"

which seems a little too generalized for the rule description.

There were multiple image links under that path referenced in the message, also
found in the debug output:

Sep  2 11:56:37.247 [569595] dbg: rules: ran uri rule __URI_GOOG_STO_IMG
======> got hit:
"https://storage.googleapis.com/msgsndr/puCpvEOKXOg4IDjMm7V9/media/d9577383-8b8b-48cf-bab2-905b2dd9a709.png"
Sep  2 11:56:37.247 [569595] dbg: rules: ran uri rule __URI_GOOG_STO_IMG
======> got hit:
"https://storage.googleapis.com/msgsndr/puCpvEOKXOg4IDjMm7V9/media/61de7f5a-55c4-475a-9850-c9a1d1085212.png"
Sep  2 11:56:37.247 [569595] dbg: rules: ran uri rule __URI_GOOG_STO_IMG
======> got hit:
"https://storage.googleapis.com/msgsndr/puCpvEOKXOg4IDjMm7V9/media/25c1ce98-dabc-4ca8-a347-d6bf252b32f1.png"
Sep  2 11:56:37.247 [569595] dbg: rules: ran uri rule __URI_GOOG_STO_IMG
======> got hit:
"https://storage.googleapis.com/msgsndr/I3rYJ9vomGYfmrsr3L10/media/68765f76a07103928fb1e1db.png"
Sep  2 11:56:37.247 [569595] dbg: rules: ran uri rule __URI_GOOG_STO_IMG
======> got hit:
"https://storage.googleapis.com/msgsndr/puCpvEOKXOg4IDjMm7V9/media/c2fae22f-f805-4cad-bd7c-b2c8179ebc18.gif"

It also looks like this is receiving a hand-forced score in
73_sandbox_manual_scores.cf;  the RulesQA-generated score in 72_scores.cf as of
writing looks to be just barely low enough this message wouldn't have gotten
tagged in set 4 (maybe with a bit more support from Bayes and/or AWL).  (2.701
2.810 2.701 2.810)

-- 
You are receiving this mail because:
You are the assignee for the bug.