Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 2 replies
  • Subscribers 1 subscriber
  • Views 9974 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Create RegEX/Filter in PureMessage for Exchange that will block certain TLDs in E-Mail Link

jdobiash

I've tried making them but it only seems to work if it's in the actual text and not the URL itself.  Is there someway to make it match within the HREF tag of the message?  i'm trying to block anything that has a URL/link that references the .DATE TLD.



This thread was automatically locked due to age.
  • 0
    Welp, this is disappointing. I even contacted support and their response to was to shoot me over to 'professional services' so I could pay money to have someone answer my question. I already have the RegEx:

    ((http(s|):)\S+\.(review|faith|work|win|date|country|kim|xyz)(\/\S+)?\b)(\/|)\s

    It just doesn't seem to work with the non-text aspect of the body, the underlying HTML. If filters won't work against it, that's fine, I just want to know one way or the other.
  • 0

    Hi Jdobiash,

    I believe you will want to set up a content filtering rule, in regards to the catch rate there may be some issues with the regular expression you are using.

    You can test it out at www.regexpal.com (that's the site I use)

    So in the top bar, paste in your regular expression, then in the bottom bar paste in the test data below.

    top window:

    -- cut --this should be all 1 line in the upper box(no blank space)
    ((http(s|):)\S+\.(review|faith|work|win|date|country|kim|xyz)(\/\S+)?\b)(\/|)\s
    -- cut --

    bottom window:

    ---cut ---
    http://www.myfile.faith this is a test of text after the address
    not ure https://www.myfile.work will it work?
    if there is text in front www.myfile.work of the address
    text with no spaceftp://www.myfile.country
    https://www.myfile.kim ejkrker
    http://www.xyz.com
    https://wwww.googles.xyz.com
    https://myfile.faith
    www://myfile.review
    https://www.date.com
    https://www.myfile.com.kim
    ftp://myfile.win
    ftp://www.myfile.win
    if the is text in front of the url<a href="www.w3schools.faith">Visit W3Schools.faith!</a> or even after it will find it
    <a href="www.w3schools.country">Visit W3Schools.com!</a> It will still match a linked ref even if the display name is incorrect
    <a href="www.w3schools.win">Visit W3Schools.win!</a>
    <a href="www.w3schools.work">Visit W3Schools.work!</a>
    --- cut ---

    As you will see the current regular expression seems to only match a few (4) of the test entries.

    I fiddled with it a little bit and came up with this one:

    all on 1 line:

    --- cut --
    \b((https?|ftp|file|www)://|(www|ftp)\.)*.\S+(review|faith|work|win|date|country|kim|xyz)
    --- cut ---


    other then the false positive for https://wwww.googles.xyz.com where the fqdn ends in .com. this rule is very tight.

    You may need to further adjust it for your needs.

    Just make sure its in the filtering rules and it should be good.

    Hope that helps.

    *** Note ***

    With all regular expressions there is always a chance of error, so ensure your rule is set up to quarantine (or copy the message / cc an admin) that way if there is a false positive you can release it.

Unfiltered HTML