Andrew's Security Filter(s) v5.62 (May 10, 2009)

[usr]

Ive added a blocklist/whitelist to the Enable [SCRIPT] Removal filter to take care of the rapidshare servers complaining about enabling java.
Now its not necessary to add each manually through the script bar. While still keeping the rest of the filters active.

Fex:

Code:

[HTTP headers]
In = FALSE
Out = TRUE
Key = "! Andrew Security Filter: Enable <SCRIPT> Removal (Out)"
URL = "(^$LST(NoScriptBlock))($SET(a_script=1))"

The above needs a NoScriptBlock.txt in the list dir, and added to proxos blocklists.
Then add whatever site with wildcards to the list (fex.([^/]++.|)rapidshare.com)

Seems to work fine, maybe it could be done better, just putting the idea out there

[Kye-U]

Great idea!

That will be a goal in the next release, adding the ability to trust or even temporarily bypass certain tags

How's it running for you so far?

[usr]

Just super, not one problem till now.
And the javascript floater script is easy to edit if so inclined

[usr]

Ive been editing the filters some to include a trust scripts button instead of the trust path button.

_http://i28.tinypic.com/24n1w8k.png

Everything is working ok but i need a more generic wildcard added and i need to remove the www from the blocklist added url.

Id like to use ([^/]++.|) instead of [^/]++ (fex. ([^/]++.|)somesite.com not [^/]++www.somesite.com)

But i cant seem to figure out the changes needed.

So far ive just been using:
$ADDLST(NoScriptBlock, [^/]++$GET(host)\r)\k<meta http-equiv="refresh" content="2;url=http://$GET(origlink)">
And editing manually the blocklist entries if needed.

Any help much appreciated

[Kye-U]

In "Andrew's Security Filter - Add Safe Host", change the first line of the replacement text to:

Code:

$ADDLST(NoScriptBlock, ([^/]++.|)$GET(host)\r)\k<meta http-equiv="refresh" content="2;url=http://$GET(origlink)">

[Guest]

Thanks
Yeah ive tried that before, and it works fine with the majority of sites, unfortunately some sites has some numbers etc in the www (fex. ww5.easyshare.com or w14.easyshare.com) so im looking to add just the ([^/]++.|)easyshare.com without the www.
Hope im making myself clear, if not please let me know and ill try to elaborate more.

[Kye-U]

It's working fine here I just tested it with an easyshare download page (on w15.easy-share.com), and it added the following line to the bypass list:

([^/]++.|)easy-share.com

Can you export the filter and post it? I'll take a look.

EDIT: I've updated the "Path" filter to wildcard the URL that's entered in the whitelist

[usr]

Much appreciated

Code:

[Patterns]
Name = "Andrew's Security Filter - Add No Script Block"
Active = TRUE
URL = "(^$LST(andrew))\8(\&|\?)andrewsecurity=path$SET(origlink=\8)"
Limit = 1
Match = "?"
Replace = "$ADDLST(NoScriptBlock, ([^/]++.|)$GET(host)\r)\k<meta http-equiv="refresh" content="2;url=http://$GET(origlink)">"
          "<div style="position: absolute !important; top: 0 !important; left: 0 !important; width: 100% !important; height: 15px !important; color: white !important; background-color: white !important; font: plain 12px Tahoma,Verdana,Sans-Serif !important; text-align: center !important; border-bottom: 1px solid black !important; border-top: none !important; border-left: none !important; border-right: none !important; padding-top: 5px !important; padding-bottom: 5px !important; padding-left: 0px !important; padding-right: 0px !important; margin: 0px; z-index: 99999999999999999 !important; x-overflow: hidden !important;">"
          "Success! <a href="http://$GET(origlink)" style="font: plain 12px Tahoma,Verdana,Sans-Serif; color: black !important;; background-color: white !important; border: 1px plain black; padding: 2px; text-decoration: none;" title="Go back to original page">Click here if not redirected</a></div>"

Edit:just noticed the update. Sweet.... ill upgrade and get back, thanks again

[Kye-U]

Your filter is customized, so I'll help update it for you =]

Code:

[Patterns]
Name = "Andrew's Security Filter - Add No Script Block"
Active = TRUE
URL = "(^$LST(andrew))(\w.|)\7\8.\9/\0(\&|\?)andrewsecurity=path$SET(origlink=\7\8.\9/\0)$SET(path=\8.\9/\0)"
Limit = 1
Match = "?"
Replace = "$ADDLST(NoScriptBlock, [^/]++$GET(path)\r)\k<meta http-equiv="refresh" content="2;url=http://$GET(origlink)">"
          "<div style="position: absolute !important; top: 0 !important; left: 0 !important; width: 100% !important; height: 15px !important; color: white !important; background-color: white !important; font: plain 12px Tahoma,Verdana,Sans-Serif !important; text-align: center !important; border-bottom: 1px solid black !important; border-top: none !important; border-left: none !important; border-right: none !important; padding-top: 5px !important; padding-bottom: 5px !important; padding-left: 0px !important; padding-right: 0px !important; margin: 0px; z-index: 99999999999999999 !important; x-overflow: hidden !important;">"
          "Success! <a href="http://$GET(origlink)" style="font: plain 12px Tahoma,Verdana,Sans-Serif; color: black !important;; background-color: white !important; border: 1px plain black; padding: 2px; text-decoration: none;" title="Go back to original page">Click here if not redirected</a></div>"

[usr]

thanks a bunch man, that did the trick. Im all set now, that was very kind

[Kye-U]

Version 4 has been released! Check the first post for more details.

[z12]

Regarding "Andrew's Security Filter v4" web filter:

It looks like theres 12 $TST() for every pass the filter can't match.
Over the span of a web page, the ratio of filter misses to hits must be rather high.
That's a lot of testing.

Seems like something this would require fewer $TST() overall:

Code:

(
(^(^<(script|noscript|applet|object|embed|iframe)))
(^$TST(bypassing=yes))$SET(1=)

(
<script
$TST(a_script=1)
*</script>
$TST(($GET(scriptn)+)=$LST(Count)|*)$SET(scriptn=$GET(i))

|
<noscript
$TST(a_noscript=1)
*</noscript>
$TST(($GET(noscriptn)+)=$LST(Count)|*)$SET(noscriptn=$GET(i))

...snipped...

)
$SET(andrew=yes)
)

|
</(body|html)\2>$STOP()
...snipped...

BTW do you have a test page set up for these filters?

z12

[Kye-U]

Thank you! I will update the filter with your optimized matching expression when I get home today. (It looks much better)

I'll also set up a test page =]

[z12]

Just an FYI

Code:

### iframe tweak

|
<iframe
$TST(a_iframe=1)
(
*src=$AV(\6)*</iframe>
$SET(1=
<a href="\6" style="background-color: yellow !important; font-size: 8px !important;" title="\6" target="_new">
<b>[iframe]</b>
</a>
)
|
\2</iframe>(^$TST(\2=*\ssrc*))
)
$TST(($GET(iframen)+)=$LST(Count)|*)$SET(iframen=$GET(i))



### /(body|html) tweak

|
</(body|html)\2>$STOP()
(^$TST(warndisplayed=yes))$SET(warndisplayed=yes)
(
$TST(bypassing=yes)
$SET(1=
<script type="text/javascript" src="http://local.ptron/andrew.js"></script>\r\n
<script type="text/javascript">\r\n
prx_a_array(0, 0, 0, 0, 0, 0, "$GET(sep)", 2, "$GET(origlink)");\r\n
</script>
)
|
$TST(andrew=yes)
$SET(1=
<script type="text/javascript" src="http://local.ptron/andrew.js"></script>\r\n
<script type="text/javascript">\r\n
prx_a_array($GET(scriptn), $GET(noscriptn), $GET(appletn), $GET(objectn), $GET(embedn), $GET(iframen), "$GET(sep)", 1, "");\r\n
</script>
)
)

I was kind of wondering about the position of (^$TST(warndisplayed=yes))
Seems like no script will be injected if "yes".
I'm sure it's just my unfamiliarity with the filters and not a problem.

Also, is \2 used somehow? (in the body|html)

Kye-U Wrote:I'll also set up a test page

Cool.

I was thinking of doing something like this myself.
Looks like my work might already be done.

z12

[Kye-U]

I've updated the first post =]

I forgot to reuse the \2 to insert the </(body|html)> tag, and the (^$TST(warndisplayed=yes)) test was to make sure the Javascript wasn't already matched, e.g. if it already matched with </body>, I didn't want it to match again with </html>. But I had forgotten about the STOP() function! (So I have removed (^$TST(warndisplayed=yes))$SET(warndisplayed=yes) text, and also put in code to put back the </(body|html)> tag) Thanks =]

The test page is here: http://prxbx.com/test/test.html

I'm not sure if it's as comprehensive as you'd imagined it to be, but I included all the tags that this filter removes on that page, and tried my best to add some annoyance (some nice popups, some nice midi music in the background, perfect for a romantic dinner). Please let me know if you have any suggestions on making it a heavyduty testing page =] You've been VERY helpful