Trinidad,
src="http is way to general a block. For example, just about everything you get from Microsoft will get blocked by this (which may or may not be a bad thing). I have worked with several iterations of this kind of block. I am still changing them as I gather more statistics but here is my latest:
The first on gets rid of url's using "Dotted IP" notation rather than FQDN's. This can be dangerous but we have taken the stance that if you can't put a DNS host name on it, we don't want it.
(href=" http://+[\d" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://+" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - http://+ [\d])
This one detects http OR 3dhttp Then // Then 0 - 15 of ANY character Then a % OR an @ followed by just about anything.
((http|3dhttp)://.{0,15}( mailto:%|@)[(\d|\w" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - %|@)[(\d|\w )])
While they don't drop all the "remote" refs, they are doing an excellent job with very few "False Positives"
Hope this helps.
Dan S.
|