commit 0248bd6: [Rules] Micro-optimize X_PHP_EVAL

[Anton Yuzhaninov]

Author: Anton Yuzhaninov
Date: 2021-08-05 15:54:20 +0100
URL: https://github.com/rspamd/rspamd/commit/0248bd6615e29e8b4b910cfe854a73b6f3462499 (refs/pull/3838/head)

[Rules] Micro-optimize X_PHP_EVAL
Remove /i flag from regexp string "eval()'d code" is always in
lower case. While here use long string format for readability.

---
 rules/regexp/compromised_hosts.lua | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/regexp/compromised_hosts.lua b/rules/regexp/compromised_hosts.lua
index 97d80853e..0a9a9f0aa 100644
--- a/rules/regexp/compromised_hosts.lua
+++ b/rules/regexp/compromised_hosts.lua
@@ -92,7 +92,7 @@ reconf['HAS_X_ANTIABUSE'] = {
 }
 
 reconf['X_PHP_EVAL'] = {
-  re = "X-PHP-Script=/eval\\(\\)\\'d/Hi || X-PHP-Originating-Script=/eval\\(\\)\\'d/Hi",
+  re = [[X-PHP-Script=/eval\(\)'d code/H || X-PHP-Originating-Script=/eval\(\)'d code/H]],
   description = "Message sent using eval'd PHP",
   score = 4.0,
   group = "compromised_hosts"